Back to articles
Vulnerabilities 2 min read CVSS 8.8

March 2026 Patch Tuesday: 84 Microsoft flaws, 2 zero-days

Key Takeaways

  • 84 vulnerabilities patched by Microsoft, including 2 publicly disclosed zero-days
  • CVE-2026-21262 (CVSS 8.8): privilege escalation in SQL Server, patch within 48h
  • Google Chrome: 2 zero-days actively exploited in the wild, update immediately
  • Android: 129 vulnerabilities including CVE-2026-21385 (Qualcomm, actively exploited)

March 2026 Patch Tuesday summary

Microsoft released its monthly Patch Tuesday on March 10, 2026, addressing 84 vulnerabilities including 2 publicly disclosed zero-days. This bulletin is particularly dense and warrants immediate attention from IT and security teams.

The 2 zero-days to watch

CVE-2026-26127 (CVSS 7.5): Denial of service vulnerability in .NET 9.0 and 10.0. While the CVSS score is moderate, public disclosure before patching increases exploitation risk.

CVE-2026-21262 (CVSS 8.8): Privilege escalation in SQL Server. An authenticated attacker can gain administrative rights on the SQL instance. High priority for database environments.

Beyond Microsoft

March 2026 has been a busy month for patches across the board:

  • Google Chrome: 2 zero-days actively exploited in the wild, patched urgently. Update immediately.
  • Android: 129 vulnerabilities patched, including CVE-2026-21385 (Qualcomm, actively exploited) and CVE-2026-0006 (critical remote code execution).

Prioritization for security teams

PriorityCVEProductCVSSAction
CriticalCVE-2026-0006AndroidCriticalImmediate patch
CriticalChrome zero-daysChromeHighUpdate browsers
HighCVE-2026-21262SQL Server8.8Patch within 48h
HighCVE-2026-21385Android/QualcommHighMobile patch
MediumCVE-2026-26127.NET7.5Patch within 7 days

Recommendations

  1. Deploy Chrome patches first: zero-days are being actively exploited.
  2. SQL Server: if you expose instances on the network, CVE-2026-21262 is critical.
  3. Mobile fleet: coordinate with your MDM to push Android patches.
  4. Test before deploying: as always, validate patches in a staging environment before production rollout.

Sources

Advertisement

Related Articles