Microsoft Patches 84 Flaws - AI Found the Worst One

The most dangerous vulnerability in Microsoft's March 2026 Patch Tuesday was not found by a human. XBOW, an autonomous AI penetration testing agent that holds the #1 spot on HackerOne's U.S. bug bounty leaderboard, discovered CVE-2026-21536 - a CVSS 9.8 remote code execution flaw in Microsoft's Devices Pricing Program. It's one of the first vulnerabilities identified by an AI agent and officially credited with a CVE.

But the AI story cuts both ways. The same patch batch fixes CVE-2026-26144, an Excel XSS vulnerability that turns Microsoft's own Copilot Agent into an unwitting data exfiltration tool - zero clicks required. And CVE-2026-26118 puts an SSRF in Azure's MCP Server, letting attackers steal managed identity tokens through the protocol that's supposed to make AI agents safer.

AI found the worst bug. AI features created two of the most interesting new ones. That's the March 2026 Patch Tuesday in one sentence.

The Numbers

Microsoft patched 84 vulnerabilities: 8 Critical, 76 Important. Two were publicly disclosed zero-days. None were under active exploitation at release.

Category	Count
Privilege escalation	46
Remote code execution	18
Information disclosure	10
Spoofing	4
Denial of service	4
Security feature bypass	2

Six privilege escalation bugs were marked "exploitation more likely," including CVE-2026-25187, a Winlogon weakness discovered by James Forshaw of Google Project Zero.

CVE-2026-21536: The AI-Found Critical

XBOW's discovery carries a CVSS score of 9.8 - the highest in this month's release. The flaw is a remote code execution vulnerability in Microsoft's Devices Pricing Program, a cloud service. Microsoft has already mitigated it server-side; no customer action is needed.

What makes this striking is the discoverer. XBOW is a fully autonomous offensive security platform that reached the #1 position on HackerOne's U.S. leaderboard in 90 days, submitting nearly 1,060 vulnerabilities across that period. In a live benchmark across 104 real-world scenarios, XBOW completed in 28 minutes what a seasoned human pentester needed 40 hours for - an 85x speed advantage.

Ben McCarthy of Immersive Labs noted: "XBOW has consistently ranked at or near the top of the HackerOne bug bounty leaderboard for the past year."

The severity breakdown of XBOW's HackerOne submissions over the past 90 days tells its own story: 54 critical, 242 high, 524 medium, and 65 low severity issues. The platform previously discovered an unknown vulnerability in Palo Alto's GlobalProtect VPN affecting over 2,000 hosts. When the output of an autonomous agent is a CVSS 9.8 flaw in a Microsoft cloud service, the pace advantage shifts decisively toward offense.

XBOW autonomous security platform homepage XBOW's autonomous penetration testing platform reached #1 on HackerOne's U.S. bug bounty leaderboard, submitting over 1,000 vulnerabilities. Source: xbow.com

CVE-2026-26144: When Excel XSS Meets Copilot

This one shows a new class of attack. CVE-2026-26144 is a textbook cross-site scripting flaw (CWE-79) in Excel's web rendering pipeline. Normally, an XSS in a spreadsheet application would be a moderate concern. Paired with Copilot Agent, it becomes a zero-click data exfiltration channel.

The attack chain works like this:

Attacker embeds crafted input into an Excel workbook
Excel's web renderer fails to sanitize the input
The manipulated rendering context triggers Copilot Agent's automated processing
Copilot - which has network privileges and runs in the user's security context - makes outbound requests to an attacker-controlled endpoint
Data exfiltrates without the user clicking, opening, or interacting with the file

The zero-click mechanism is the critical detail. Exploitation can occur through automatic file preview in email clients, background document processing, or server-side ingestion workflows. The user never needs to open the file.

As the Zero Day Initiative noted, CVE-2026-26144 shows how "small, well-understood bugs like XSS can have outsized effects when composed with new capabilities like Copilot." The AI agent's autonomous nature - its ability to read, summarize, and act on document content with network access - turns a classic web vulnerability into something qualitatively different.

Close-up of a security terminal display The Excel-Copilot attack chain represents a new vulnerability class where traditional web flaws gain outsized impact through AI agent capabilities. Source: pexels.com

This isn't the first time Copilot's security surface has caused problems. But it's the first CVE that explicitly describes an AI agent being weaponized through a traditional vulnerability class.

CVE-2026-26118: MCP Server Goes Wrong

The Azure MCP Server SSRF (CVSS 8.8) hits a nerve for anyone building agentic AI systems. The Model Context Protocol is supposed to be the standardized way AI agents interact with external tools and services. A server-side request forgery in that layer lets an authorized attacker send a malicious URL where an Azure resource identifier should go. The MCP Server dutifully sends an outbound request to that URL - and includes its managed identity token in the process.

With the stolen token, the attacker inherits whatever permissions the managed identity has been assigned - potentially spanning entire service boundaries. The attack requires understanding Azure's role-based access control chains, but for anyone already inside an Azure environment, this is a direct path to lateral movement.

The irony is sharp. MCP was designed to give AI agents safe, structured access to tools and data. CVE-2026-26118 shows that the protocol infrastructure itself can become an attack vector - and that AI agent frameworks introduce plumbing that traditional security models haven't yet learned to protect.

The Two Zero-Days

CVE-2026-26127 (CVSS 7.5) - A denial-of-service vulnerability in .NET. Publicly disclosed before the patch. No evidence of active exploitation.

CVE-2026-21262 (CVSS 8.8) - An elevation of privilege flaw in SQL Server 2016 and later. An attacker on the network can escalate to sysadmin. The vulnerability was credited to database expert Erland Sommarskog, who documented the underlying behavior in a technical article.

Everything Else

The remaining patches follow familiar patterns. Two Office remote code execution bugs (CVE-2026-26113 and CVE-2026-26110, both CVSS 8.4) are exploitable through Outlook's Preview Pane - no attachment opening required. A Windows Print Spooler RCE (CVE-2026-23669, CVSS 8.8) drew a wince from ZDI's Dustin Childs: "Just reading the title makes me twitch" - a reference to the PrintNightmare saga that haunted administrators for years.

Adobe shipped 80 CVEs across eight bulletins in the same cycle. Microsoft also announced that hotpatch security updates will be enabled by default starting May 2026, promising "90% compliance in half the time."

Three of this month's 84 patches tell a story that the other 81 do not. An AI agent found a critical vulnerability faster than any human could. An AI assistant turned a routine XSS into a zero-click exfiltration channel. And the protocol built to make AI agents safe had a hole that let attackers steal identity tokens. The security implications of AI coding tools have been discussed abstractly for months. March 2026's Patch Tuesday made them concrete - on both sides of the fence.

Sources: