March 2026 Patch Tuesday fixes two zero-day vulnerabilities

Microsoft's Patch Tuesday fixes 79 CVEs, including two notable issues: CVE-2026-21262 (SQL Server privilege escalation, CVSS 8.8) which can allow an authenticated attacker to escalate to sysadmin over the network, and CVE-2026-26127 (.NET 9.0/10.0 denial-of-service, CVSS 7.5) affecting runtimes across Windows/macOS/Linux; additional Office RCE and Excel information-disclosure flaws are also addressed. The advisory reports no known active exploitation of these flaws, emphasizes applying the available patches immediately, and includes step-by-step Windows Update instructions to ensure systems are protected.