The March 2026 Patch Tuesday reveals four attack paths that still define real‑world breaches. From RCE to phishing‑driven Office exploits, here’s what CISOs must prioritize now.
Microsoft’s latest Patch Tuesday release addresses 84 vulnerabilities across the Windows ecosystem and associated services. Several of these disclosures were already mitigated by Microsoft within their cloud or service infrastructure prior to publication, meaning no customer action is required. For security leaders, however, the number of vulnerabilities is rarely the most important metric. Experienced defenders understand that only a small number of weaknesses typically shape real-world attack campaigns. While vulnerability counts fluctuate each month, attackers continue to rely on a consistent set of techniques to compromise enterprise environments. Understanding these attack paths allows organisations to prioritise patching efforts where they matter most.
Remote Code Execution vulnerabilities remain the most dangerous class of vulnerability because they allow attackers to compromise systems directly over the network. When exposed services remain unpatched, attackers can scan for vulnerable systems and deliver exploits remotely, gaining immediate access to internal infrastructure.
Internet scan ↓ Vulnerable service discovered ↓ Exploit delivered to target system ↓ Remote code execution ↓ Internal system compromise ↓ Attacker begins lateral movement
This attack pattern is not theoretical. Vulnerabilities such as EternalBlue (CVE-2017-0144) enabled remote exploitation of exposed SMB services and were used in the WannaCry ransomware outbreak, allowing attackers to compromise vulnerable systems directly from the internet.
Privilege escalation vulnerabilities allow attackers who already have limited access to elevate privileges and gain full control of a compromised system. Once elevated privileges are obtained, attackers can harvest credentials, disable security controls, and deploy ransomware across the enterprise environment.
Phishing email delivered ↓ User account compromised ↓ Attacker gains access to workstation ↓ Privilege escalation vulnerability exploited ↓ SYSTEM privileges obtained ↓ Credential theft and ransomware deployment
Privilege escalation vulnerabilities such as HiveNightmare (CVE-2021-36934) demonstrated how attackers with limited user access could extract sensitive credential data from Windows systems, enabling escalation to administrative privileges and broader system compromise.
Certain Windows services have historically been attractive attack targets due to their elevated privileges and widespread deployment across enterprise environments. The Windows Print Spooler service is a prime example, where vulnerabilities have allowed attackers to escalate privileges and move laterally across networks.
Initial workstation compromise ↓ Print Spooler vulnerability exploited ↓ Privilege escalation achieved ↓ Attacker moves laterally across network ↓ Additional servers compromised
The PrintNightmare vulnerability (CVE-2021-34527) demonstrated how flaws in the Windows Print Spooler service could allow attackers to execute code with SYSTEM privileges and move laterally across enterprise environments.
Many breaches still begin with a malicious document delivered through phishing campaigns. Office vulnerabilities often require user interaction, but phishing attacks remain highly effective because attackers rely on social engineering rather than purely technical exploits.
Malicious Excel document delivered via phishing ↓ User opens file ↓ Vulnerability exploited ↓ Code execution ↓ Workstation compromise ↓ Attacker begins lateral movement
Document-based exploits such as Follina (CVE-2022-30190) demonstrated how malicious Office documents could trigger remote code execution when opened by a user, providing attackers with an entry point into corporate environments.
Patch Tuesday releases often contain dozens of vulnerabilities, but history consistently shows that only a small number ultimately shape real-world attack campaigns. The most dangerous weaknesses are those that align with known attacker playbooks: gaining initial access, escalating privileges, and moving laterally across enterprise environments.
When attack chains succeed, the organisations that recover fastest are the ones that minimise business disruption.
Patch smart. Build resilience. Happy patching.
See the Mar2026 Patch Tuesday Chart (PDF) .
As always, Patch Tuesday brings critical updates and security fixes to keep your systems protected. Here’s a breakdown of the most significant issues and why you should prioritize addressing them immediately.
Explore December 2025 Patch Tuesday highlights, including 57 vulnerabilities with 2 critical fixes. Learn how to prioritize patches and secure your endpoints.
When planning for 2022 budgets, many organizations will build in money for new devices. Laptops often represent a sizable percentage of that budget for many, and no one wants to have to factor in added cost for stolen devices.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
