Microsoft Patch Tuesday March 2026 critical vulnerabilities
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft issues critical patches for multiple products including Windows, Office, and Azure; no active exploitation reported.
Microsoft released patches on March 10, 2026 for multiple critical vulnerabilities across a broad range of products and services. The most severe vulnerabilities could allow remote code execution, enabling attackers to gain the privileges of the logged-on user. Successful exploitation could permit installation of programs, data modification or deletion, and creation of new accounts with full user rights. The impact severity depends on user privilege levels, with administrative accounts at greater risk.
The vulnerability advisory covers an extensive list of affected systems spanning core Windows components (kernel, GDI, Win32K), Azure cloud services (Arc, Entra ID, compute gallery), Active Directory, SQL Server, Microsoft Office suite, and specialized services including the Print Spooler, Bluetooth drivers, Hyper-V, and RRAS. The advisory notes no current in-the-wild exploitation. CIS-MS ISAC recommends immediate patching after testing, implementation of vulnerability management processes, least-privilege account policies, network segmentation, and exploit protection features.
Detection guidance
Print Spooler Service Spawning Command Interpreter or Script Host
spoolsv.exe spawning a shell or script host, a common sign of Print Spooler exploitation for code execution or privilege escalation. The March 2026 advisory lists Print Spooler among the affected components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Print Spooler Service Spawning Command Interpreter or Script Host
id: 2a259de9-d1c0-5b23-a99d-f45c33086309
status: experimental
description: Detects the Windows Print Spooler service (spoolsv.exe) spawning a command
interpreter or script host. This is post-exploitation behaviour seen when Print
Spooler vulnerabilities are abused for code execution or elevation to SYSTEM. Matches
the parent/child relation, not any specific CVE or payload.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \spoolsv.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection
falsepositives:
- Legacy printer driver or vendor print-management software that runs batch or cmd
helpers from the spooler service
- Print-server administration scripts triggered through spooler hooks
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-march-10-2026_2026-021
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-march-10-2026_2026-021
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs