Microsoft's security release of 10 March 2026
Patch Tuesday, March 2026
As of , CISA lists none of the 78 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first by our order: CVE-2026-24294, Windows SMB Server Elevation of Privilege.
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 78 CVEs |
| On CISA's list of exploited vulnerabilities | none |
| CISA's SSVC exploitation: active | none |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 77 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | none |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-24294Windows SMB Server Elevation of Privilege | Proof of concept | Not on CISA's list | 7.8 High | 0.05 |
| 2 | CVE-2026-24289Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.05 |
| 3 | CVE-2026-23668Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.04 |
| 4 | CVE-2026-26114Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.03 |
| 5 | CVE-2026-24291Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 6 | CVE-2026-25187Winlogon Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 7 | CVE-2026-26130ASP.NET Core Denial of Service | None | Not on CISA's list | 7.5 High | 0.03 |
| 8 | CVE-2026-21262SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.02 |
| 9 | CVE-2026-25166Windows System Image Manager Assessment and Deployment Kit (ADK) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.02 |
| 10 | CVE-2026-20967System Center Operations Manager (SCOM) Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 11 | CVE-2026-23654GitHub: Zero Shot SCFoundation Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 12 | CVE-2026-23669RPC Runtime Library Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 13 | CVE-2026-25177Active Directory Domain Services Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 14 | CVE-2026-25188Windows Telephony Service Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 15 | CVE-2026-26106Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 16 | CVE-2026-26115SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2026-26116SQL Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2026-26118Azure MCP Server Tools Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2026-26105Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 8.1 High | 0.01 |
| 20 | CVE-2026-25172Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 21 | CVE-2026-25173Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 22 | CVE-2026-26111Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 23 | CVE-2026-24293Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 24 | CVE-2026-25190Windows GDI Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2026-23661Azure IoT Explorer Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 26 | CVE-2026-23662Azure IoT Explorer Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 27 | CVE-2026-23664Azure IoT Explorer Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 28 | CVE-2026-23674MapUrlToZone Security Feature Bypass | None | Not on CISA's list | 7.5 High | 0.01 |
| 29 | CVE-2026-25181GDI+ Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 30 | CVE-2026-26121Azure IOT Explorer Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 31 | CVE-2026-26127.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 32 | CVE-2026-26144Microsoft Excel Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 33 | CVE-2026-25180Windows Graphics Component Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 34 | CVE-2026-25186Windows Accessibility Infrastructure (ATBroker.exe) Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 35 | CVE-2026-26123Microsoft Authenticator Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 36 | CVE-2026-25185Windows Shell Link Processing Spoofing | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 37 | CVE-2026-24283Multiple UNC Provider Kernel Driver Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 38 | CVE-2026-26109Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 39 | CVE-2026-26110Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 40 | CVE-2026-26113Microsoft Office Remote Code Execution | None | Not on CISA's list | 8.4 High | 0.00 |
| 41 | CVE-2026-26148Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.00 |
| 42 | CVE-2026-23660Windows Admin Center in Azure Portal Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 43 | CVE-2026-23665Linux Azure Diagnostic extension (LAD) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 44 | CVE-2026-23672Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 45 | CVE-2026-23673Windows Resilient File System (ReFS) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 46 | CVE-2026-24287Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 47 | CVE-2026-24290Windows Projected File System Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 48 | CVE-2026-24292Windows Connected Devices Platform Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 49 | CVE-2026-25165Performance Counters for Windows Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 50 | CVE-2026-25174Windows Extensible File Allocation Table Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 51 | CVE-2026-25175Windows NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 52 | CVE-2026-25176Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 53 | CVE-2026-25189Windows DWM Core Library Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 54 | CVE-2026-26107Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 55 | CVE-2026-26108Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 56 | CVE-2026-26112Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 57 | CVE-2026-26117Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 58 | CVE-2026-26128Windows SMB Server Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 59 | CVE-2026-26131.NET Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 60 | CVE-2026-26132Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 61 | CVE-2026-26134Microsoft Office Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 62 | CVE-2026-26141Hybrid Worker Extension (Arc‐enabled Windows VMs) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 63 | CVE-2026-25167Microsoft Brokering File System Elevation of Privilege | None | Not on CISA's list | 7.4 High | 0.00 |
| 64 | CVE-2026-23667Broadcast DVR Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 65 | CVE-2026-23671Windows Bluetooth RFCOM Protocol Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 66 | CVE-2026-24285Win32k Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 67 | CVE-2026-24295Windows Device Association Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 68 | CVE-2026-24296Windows Device Association Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 69 | CVE-2026-25170Windows Hyper-V Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 70 | CVE-2026-25171Windows Authentication Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 71 | CVE-2026-25178Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 72 | CVE-2026-25179Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 73 | CVE-2026-24288Windows Mobile Broadband Driver Remote Code Execution | None | Not on CISA's list | 6.8 Medium | 0.00 |
| 74 | CVE-2026-24297Windows Kerberos Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.00 |
| 75 | CVE-2026-25168Windows Graphics Component Denial of Service | None | Not on CISA's list | 6.2 Medium | 0.00 |
| 76 | CVE-2026-25169Windows Graphics Component Denial of Service | None | Not on CISA's list | 6.2 Medium | 0.00 |
| 77 | CVE-2026-23656Windows App Installer Spoofing | None | Not on CISA's list | 5.9 Medium | 0.00 |
| 78 | CVE-2026-24282Push message Routing Service Elevation of Privilege | None | Not on CISA's list | 5.5 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 10 March 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.