Microsoft Patch Tuesday March 2026, (Tue, Mar 10th)
Source SANS ISC Handlers Diary
Rated Critical by SANS ISC Handlers Diary
Data as of 16 Mar 2026, 19:22 UTC
What to do
AI-suggested
Organizations should immediately prioritize deploying the March 2026 Microsoft security updates across all affected systems, focusing first on critical vulnerabilities that allow remote code execution and privilege escalation. Patch management processes must ensure coverage of Microsoft Office suites, SQL Server instances, Windows OS components (including kernel, Print Spooler, and networking services), Microsoft Edge browsers, and Azure-related services where applicable. For cloud services like Devices Pricing Program and Payment Orchestrator, verify that Microsoft’s patches are applied and monitor vendor communications for updates. Employ network segmentation and least privilege principles to limit exposure of vulnerable services, especially SQL Server and Active Directory. Enable and monitor logging and alerting for unusual activities related to privilege escalation or code execution attempts. Conduct vulnerability scanning and penetration testing post-patching to confirm remediation. Disable or restrict legacy or unnecessary services that may be affected by these vulnerabilities. Maintain up-to-date backups and incident response plans to mitigate potential exploitation impacts. Additionally, educate users about phishing and social engineering risks that could leverage spoofing vulnerabilities. Finally, monitor threat intelligence feeds for emerging exploit activity related to these CVEs to adjust defenses accordingly.
Description
Microsoft today released patches for 93 vulnerabilities, including 9 vulnerabilities in Chromium affecting Microsoft Edge.8 of the vulnerabilities are rated critical.2 were disclosed prior to today but have not yet been exploited. This update addresses no already-exploited vulnerabilities.