12 Mar Microsoft March 2026 Patch Tuesday: 84 Security Vulnerabilities Patched Including Two Zero-Days
Microsoft has released its March 2026 Patch Tuesday security update, addressing a significant number of vulnerabilities across its product ecosystem. This month’s update fixes 84 security vulnerabilities, including two publicly disclosed zero-day flaws that pose immediate security risks to organizations.
Critical Security Updates Overview
Of the 84 vulnerabilities patched this month, 8 are rated Critical and 76 are rated Important in severity. The vulnerabilities span across various Microsoft products including Windows, Office, SQL Server, .NET Framework, Azure components, and the Edge browser.
The vulnerability breakdown by type reveals the security landscape facing IT administrators:
- 46 privilege escalation vulnerabilities – the largest category
- 18 remote code execution flaws
- 10 information disclosure vulnerabilities
- 4 spoofing vulnerabilities
- 4 denial-of-service flaws
- 2 security feature bypass issues
Two Zero-Day Vulnerabilities Demand Immediate Attention
The most concerning aspect of this month’s Patch Tuesday are the two publicly disclosed zero-day vulnerabilities that were already known to attackers before Microsoft could issue fixes:
CVE-2026-26127: .NET Denial-of-Service Vulnerability
This vulnerability affects .NET frameworks with a CVSS score of 7.5. While classified as a denial-of-service attack, it could potentially disrupt critical business applications and services that rely on .NET technology.
CVE-2026-21262: SQL Server Privilege Escalation
With a higher CVSS score of 8.8, this SQL Server vulnerability allows attackers to escalate privileges, potentially gaining unauthorized access to sensitive database information. For dental practices using SQL Server-based practice management systems, this represents a significant security risk.
Highest Severity Vulnerability Already Mitigated
The vulnerability with the highest CVSS score in this update is CVE-2026-21536 (CVSS score: 9.8), affecting the Microsoft Devices Pricing Program. However, Microsoft reports this critical remote code execution flaw has been fully mitigated, requiring no action from users.
This vulnerability was discovered by XBOW, an AI-powered autonomous vulnerability discovery platform, highlighting the growing role of artificial intelligence in cybersecurity research.
Recommendations for IT Administrators
Given the presence of two zero-day vulnerabilities, IT administrators should prioritize immediate deployment of these security updates:
- Deploy patches immediately for the zero-day vulnerabilities, especially in environments running .NET applications or SQL Server
- Inventory affected systems to ensure comprehensive coverage
- Test critical applications after patching to verify functionality
- Monitor systems for any unusual activity that might indicate exploitation attempts
- Review backup procedures to ensure data recovery capabilities in case of security incidents
Dental Practice Security Considerations
For dental practices, these vulnerabilities are particularly concerning as many practice management systems rely on SQL Server databases and .NET frameworks. Patient data security and HIPAA compliance requirements make immediate patching essential.
Dental IT administrators should:
- Coordinate with practice management software vendors to ensure compatibility
- Schedule patching during off-hours to minimize practice disruption
- Verify that backup systems and patient data remain secure throughout the update process
- Consider additional network security measures while patches are being deployed
Additional Edge Browser Updates
Beyond the 84 vulnerabilities addressed in the main Patch Tuesday release, Microsoft has also fixed 10 additional vulnerabilities in its Chromium-based Edge browser since the February 2026 Patch Tuesday update. These browser security fixes address various attack vectors that could compromise user data and system security.
The March 2026 Patch Tuesday represents another significant security milestone, demonstrating Microsoft’s ongoing commitment to addressing emerging threats. However, the presence of two zero-day vulnerabilities underscores the critical importance of maintaining up-to-date security practices and rapid patch deployment procedures.
Organizations should treat this month’s updates as high priority and deploy them as quickly as possible while maintaining proper testing protocols to ensure business continuity.