Source: Help Net Security
Author: Zeljka Zorz
URL: https://www.helpnetsecurity.com/2026/03/11/march-2026-patch-tuesday/
ONE SENTENCE SUMMARY:
Microsoft’s March 2026 Patch Tuesday fixed 80+ flaws, emphasizing privilege-escalation, Office/Print RCE, Excel Copilot XSS, and Authenticator MITM risks.
MAIN POINTS:
- March 2026 updates addressed 80+ vulnerabilities across Microsoft software and cloud services.
- Two publicly disclosed issues included SQL Server SQLAdmin escalation and .NET denial-of-service.
- Microsoft rated the disclosed SQL Server bug less likely, and .NET DoS unlikely, to exploit.
- Six “more likely” vulnerabilities were all local privilege-escalation paths to SYSTEM/admin.
- Windows Kernel use-after-free bugs (CVE-2026-24289, CVE-2026-26132) enabled elevation attacks.
- Windows Graphics race condition (CVE-2026-23668) highlighted need for patch variant investigations.
- SMB Server improper authentication (CVE-2026-24294) could facilitate privilege elevation.
- Winlogon link-resolution flaw (CVE-2026-25187) enabled escalation via file-access misresolution.
- ATBroker accessibility component (CVE-2026-24291) offered reliable limited-user to SYSTEM transition.
- Rapid patching recommended for Print Spooler RCE, Excel Copilot XSS, and Office Preview Pane RCEs.
TAKEAWAYS:
- Prioritize SYSTEM-level elevation fixes, especially ATBroker, due to broad Windows prevalence.
- Treat Office Preview Pane RCEs as high-risk given repeated patch history and likely future exploitation.
- Patch Print Spooler quickly because authenticated RCE remains a frequent enterprise attack vector.
- Evaluate Copilot/agent-assisted data exfiltration exposure from Excel XSS and tighten data controls.
- Enforce MFA app selection via MDM to reduce rogue-app deep-link MITM risk in Microsoft Authenticator.