# Microsoft Patch Tuesday March 2026 critical vulnerabilities

Published: 2026-03-10 · Severity: routine · Sectors: government-national, defense, financial-services, technology, healthcare, education
Canonical: https://vorant.io/reports/e3004055-9321-5d16-a726-2e6abcb6f267/microsoft-patch-tuesday-march-2026-critical-vulnerabilities

> Microsoft issues critical patches for multiple products including Windows, Office, and Azure; no active exploitation reported.

Microsoft released patches on March 10, 2026 for multiple critical vulnerabilities across a broad range of products and services. The most severe vulnerabilities could allow remote code execution, enabling attackers to gain the privileges of the logged-on user. Successful exploitation could permit installation of programs, data modification or deletion, and creation of new accounts with full user rights. The impact severity depends on user privilege levels, with administrative accounts at greater risk.

The vulnerability advisory covers an extensive list of affected systems spanning core Windows components (kernel, GDI, Win32K), Azure cloud services (Arc, Entra ID, compute gallery), Active Directory, SQL Server, Microsoft Office suite, and specialized services including the Print Spooler, Bluetooth drivers, Hyper-V, and RRAS. The advisory notes no current in-the-wild exploitation. CIS-MS ISAC recommends immediate patching after testing, implementation of vulnerability management processes, least-privilege account policies, network segmentation, and exploit protection features.

## Detection guidance (public sample)

### Print Spooler Service Spawning Command Interpreter or Script Host

ATT&CK: T1548

spoolsv.exe spawning a shell or script host, a common sign of Print Spooler exploitation for code execution or privilege escalation. The March 2026 advisory lists Print Spooler among the affected components. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Print Spooler Service Spawning Command Interpreter or Script Host
id: 2a259de9-d1c0-5b23-a99d-f45c33086309
status: experimental
description: Detects the Windows Print Spooler service (spoolsv.exe) spawning a command
  interpreter or script host. This is post-exploitation behaviour seen when Print
  Spooler vulnerabilities are abused for code execution or elevation to SYSTEM. Matches
  the parent/child relation, not any specific CVE or payload.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \spoolsv.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
  condition: selection
falsepositives:
- Legacy printer driver or vendor print-management software that runs batch or cmd
  helpers from the spooler service
- Print-server administration scripts triggered through spooler hooks
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-march-10-2026_2026-021
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-march-10-2026_2026-021

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e3004055-9321-5d16-a726-2e6abcb6f267/microsoft-patch-tuesday-march-2026-critical-vulnerabilities.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup