The Brief

Microsoft’s March 2026 Patch Tuesday addresses 83 vulnerabilities across Windows, Office, Azure, and SQL Server — the first monthly release in six months with no actively exploited zero-days. The cumulative updates KB5079473 and KB5078883, now rolling out to Windows 11 versions 25H2, 24H2, and 23H2, also bundle Sysmon as an optional built-in feature, Emoji 16.0 support, and improved File Explorer search reliability ahead of a looming Secure Boot certificate expiration in June.

The Report

Microsoft released its March 2026 security update on Tuesday, patching 83 vulnerabilities — eight rated critical, 75 important — across its enterprise software portfolio. Two vulnerabilities had been publicly disclosed prior to the patch: CVE-2026-21262, an elevation of privilege flaw in SQL Server with a CVSS score of 8.8, and CVE-2026-26127, a denial of service vulnerability in .NET 9.0 and 10.0. Neither was actively exploited in the wild, breaking a six-month streak of Patch Tuesday releases that included at least one known-exploited zero-day.

Elevation of privilege flaws dominated the release, accounting for 46 of the 83 vulnerabilities — more than 55 per cent. Six vulnerabilities were assessed by Microsoft as “exploitation more likely,” including use-after-free bugs in the Windows kernel (CVE-2026-24289, CVE-2026-26132) that could grant SYSTEM-level privileges, and flaws in Windows Accessibility Infrastructure, the Graphics Component, SMB Server, and Winlogon. Google Project Zero researcher James Forshaw was credited with discovering two of the six.

Two critical remote code execution vulnerabilities in Microsoft Office — CVE-2026-26110 and CVE-2026-26113, each scoring CVSS 8.4 — allow arbitrary code execution through the Preview Pane, meaning a user need only preview a malicious document to trigger the exploit. A separate Excel information disclosure flaw, CVE-2026-26144, drew attention from Trend Micro’s Dustin Childs, who noted an attacker could weaponise it to cause the Copilot Agent to exfiltrate data from a target in a zero-click operation. The highest-scoring vulnerability in the release, CVE-2026-21536 at CVSS 9.8, affected the Microsoft Devices Pricing Program but had already been fully mitigated by Microsoft before publication.

“The lack of bugs under active attack is a nice change from last month,” Childs said, referencing February’s six actively exploited vulnerabilities. Tenable’s Satnam Narang characterised the two publicly disclosed zero-days as “more bark than bite.”

Beyond security, KB5079473 brings Sysmon — previously a standalone Sysinternals download — into Windows as a native optional feature, disabled by default. The update also adds Emoji 16.0, WebP wallpaper support, a network speed test shortcut in the taskbar, and auto-enabled Quick Machine Recovery for non-domain Windows 11 Pro devices. File Explorer search across multiple drives and the “This PC” scope has been made more reliable, and a bug where Windows Defender Application Control blocked COM objects when endpoint security policies outranked allowlisting policies has been resolved.

The update also accelerates the rollout of new Secure Boot certificates, adding device-targeting data ahead of the current 2011-era certificates beginning to expire in June 2026. Microsoft reports no known issues with the release.

The Angle

The number that matters here is not 83. It is zero. Six months of consecutive Patch Tuesdays carrying actively exploited vulnerabilities, and this is the first one that arrives clean. Whether that reflects a genuine improvement in Microsoft’s pre-release security posture or simply a month where the attackers were slower than the patchers is impossible to determine from the outside. What is observable is the trajectory: the monthly patch cycle has become less a maintenance ritual and more a live-fire remediation exercise, and a month without active exploitation now qualifies as noteworthy.

The Sysmon inclusion is worth more attention than it will receive. Moving a standalone security monitoring tool into the operating system as a native feature, managed through Windows Update, is the kind of infrastructure decision that changes the baseline of what defenders can assume is available on a given endpoint. The standalone version required deliberate download, configuration, and maintenance — which meant it existed overwhelmingly on machines managed by teams that already knew they needed it. As an optional feature shipped with the OS, the addressable deployment surface expands to every Windows machine with an administrator willing to tick a box. The difference between “available if you go looking” and “available if you don’t untick it” is, in enterprise security, the difference between a capability and a default.

The Secure Boot certificate timeline deserves the plainest possible reading. Certificates issued in 2011 begin expiring in June. Devices that do not receive updated certificates will lose the ability to install Secure Boot security updates after that date. Microsoft says the process will be automatic for most users. The update being released today adds targeting data to widen that automatic coverage. Three months is not a long runway for a certificate transition affecting every Windows device with Secure Boot enabled.

The tools that defend the infrastructure the modern world runs on are being rebuilt in public, one monthly update at a time, while the certificate architecture underpinning trusted boot has three months of validity remaining.