← Back to Security Blog

Microsoft Patches 4 Zero-Days in March 2026 Patch Tuesday

Microsoft's March 2026 Patch Tuesday addresses 67 vulnerabilities including 4 actively exploited zero-days affecting Windows kernel, NTFS, and Microsoft Management Console. Immediate patching critical.

---

Patch Tuesday Overview

Microsoft's March 2026 Patch Tuesday resolves 67 vulnerabilities across Windows, Office, Azure, and .NET. Four of these are actively exploited zero-days that require immediate attention.

---

Zero-Day Vulnerabilities

CVE	Component	CVSS	Impact
CVE-2026-24983	Windows Win32 Kernel Subsystem	7.8	Elevation of Privilege — local attacker gains SYSTEM
CVE-2026-24984	Windows NTFS	4.6	Information Disclosure — sensitive data via USB
CVE-2026-24985	Windows Fast FAT File System	6.8	Remote Code Execution via malicious VHD
CVE-2026-24993	Microsoft Management Console	7.8	Remote Code Execution via crafted .msc file

---

Detailed Analysis

CVE-2026-24983 — Windows Kernel EoP (CVSS 7.8)

A use-after-free vulnerability in the Win32 kernel subsystem allows a local attacker to escalate privileges to SYSTEM. This is being used as part of post-compromise chains — once an attacker has initial access, they exploit this flaw to gain full system control.

CVE-2026-24984 — NTFS Information Disclosure (CVSS 4.6)

While lower severity, this NTFS flaw allows an attacker with physical access to read heap memory via a crafted USB device. This has been observed targeting high-value individuals in espionage campaigns.

CVE-2026-24985 — Fast FAT RCE (CVSS 6.8)

A maliciously crafted VHD file triggers a heap-based buffer overflow in the Fast FAT driver. Simply mounting the file can execute arbitrary code. Attack vector: email attachments or compromised file shares.

CVE-2026-24993 — MMC RCE (CVSS 7.8)

A specially crafted .msc file sent via email or hosted on a malicious website can execute arbitrary code when opened. Social engineering is the primary delivery mechanism — attackers send these as "IT admin tools" or "system configuration files."

---

Full Patch Summary

Severity	Count
Critical	7
Important	57
Moderate	3

---

Recommended Actions

1. Emergency patch: Deploy all four zero-day fixes within 24 hours
2. Block .msc files: Add .msc to email attachment blocking rules
3. Restrict VHD mounting: Limit auto-mount capabilities via Group Policy
4. USB device control: Implement endpoint USB device whitelisting
5. Monitor for exploitation: Watch for unusual kernel driver loading and privilege escalation events