Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days

"This month, over half (55%) of all Patch Tuesday CVEs were privilege escalation bugs, and of those, six were rated exploitation more likely across Windows Graphics Component, Windows Accessibility Infrastructure, Windows Kernel, Windows SMB Server, and Winlogon. We know these bugs are typically used by threat actors as part of post-compromise activity, once they get onto systems through other means (social engineering, exploitation of another vulnerability)."

"The vulnerability with the highest CVSS score in this month's update is a critical remote code execution flaw in the Microsoft Devices Pricing Program. CVE-2026-21536 (CVSS score: 9.8), per Microsoft, has been fully mitigated, and no action is required from users. Artificial intelligence (AI)-powered autonomous vulnerability discovery platform XBOW has been credited with discovering and reporting the issue."

"Of these, eight are rated Critical, and 76 are rated Important in severity. Forty-six of the patched vulnerabilities relate to privilege escalation, followed by 18 remote code execution, 10 information disclosure, four spoofing, four denial-of-service, and two security feature bypass flaws."

Microsoft released patches for 84 security vulnerabilities across various software components, with 8 rated Critical and 76 rated Important. The vulnerabilities include 46 privilege escalation flaws, 18 remote code execution issues, 10 information disclosure vulnerabilities, and others. Two publicly disclosed zero-days were addressed: CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server. The highest-severity flaw is CVE-2026-21536, a critical remote code execution vulnerability in the Microsoft Devices Pricing Program with a CVSS score of 9.8, discovered by AI platform XBOW. Over 55% of this month's patches address privilege escalation bugs, which threat actors typically exploit post-compromise after initial system access.

Read at The Hacker News