March 2026 Patch Tuesday: what Security and IT teams should prioritise

The operational queue contains 86 approved patch records linked to 167 unique CVEs. No records in the approved cohort currently carry an accelerated or out-of-band assessment. BlackTree urgency is separate from vendor severity, CVSS and EPSS.

Security teams should start with confirmed exploitation and exposed control-plane systems. IT administrators should then review applicability, prerequisites, restart impact, sequencing, known issues and rollback guidance on each patch detail page.

Most important Microsoft patches this month

The following fixes deserve early attention based on confirmed exploitation, public disclosure, attack path and technical impact. Applicability still depends on the products and roles deployed in each environment.

• CVE-2026-26127: .NET Denial of Service Vulnerability The issue was publicly disclosed before the update was released. Its CVSS vector describes a network attack that needs neither privileges nor user interaction. Important, CVSS 7.5.
• CVE-2026-21262: SQL Server Elevation of Privilege Vulnerability The issue was publicly disclosed before the update was released. This is most relevant after an attacker has already gained a foothold on a Windows system. Important, CVSS 8.8.
• CVE-2026-26113: Microsoft Office Remote Code Execution Vulnerability Successful exploitation can run attacker-controlled code in the affected component. Critical, CVSS 8.4.
• CVE-2026-26110: Microsoft Office Remote Code Execution Vulnerability Successful exploitation can run attacker-controlled code in the affected component. Critical, CVSS 8.4.

Open the canonical March 2026 Patch Tuesday action queue on cve.blacktree.nl.

Patch details and exploitation assessments were checked against the Microsoft Security Update Guide release data for March 2026.

Editorial article generated from approved catalogue data. Recheck the canonical cycle for later vendor revisions or BlackTree corrections.