Zero-Day Windows Security March 27, 2026

Microsoft March 2026 Patch Tuesday: 79 CVEs, Two Actively Exploited Zero-Days

March's Patch Tuesday is the heaviest of 2026 so far — two zero-days in the Windows kernel and NTFS driver are being actively exploited in the wild. Every Windows developer machine and CI runner needs this update today.

Dillip Chowdary

Founder & AI Researcher • March 27, 2026 • 7 min read

The Two Zero-Days: What Developers Need to Know

Zero-Day #1 — Windows Kernel Elevation of Privilege

The first zero-day is a privilege escalation vulnerability in the Windows kernel. An attacker who has gained low-privilege code execution on a machine — through a phishing payload, a compromised dependency, or any initial-access technique — can exploit this flaw to escalate to SYSTEM-level privileges. Microsoft confirmed it is being exploited by an advanced persistent threat (APT) actor in targeted attacks against enterprise environments.

• Attack surface: Local — attacker requires code execution on the target machine first (standard EoP chain).
• Impact: Full SYSTEM access — attacker can disable security tooling, dump credentials from LSASS, and establish persistent kernel-level implants.
• Developer relevance: Developer machines running untrusted code (npm packages, pip packages, build scripts from forks) are a realistic initial-access vector for this exploit chain.
• Affected: Windows 10 21H2+, Windows 11 all versions, Windows Server 2019–2025.

Zero-Day #2 — Windows NTFS Remote Code Execution

The second zero-day is more severe in scope: a remote code execution flaw in the Windows NTFS driver. Exploitation requires convincing a user to mount or preview a specially crafted virtual disk image — a scenario that is trivially achievable via email attachments, network shares, or malicious repositories containing .vhd / .vhdx files.

• Attack vector: User interaction — mounting or previewing a malicious virtual disk image triggers the exploit.
• Impact: Arbitrary code execution at the privilege level of the user mounting the disk.
• Developer relevance: CI/CD pipelines that mount artifacts, VM images, or container layer tarballs as part of build/test workflows are a realistic attack surface. Developers who receive disk images in code review or testing contexts are also exposed.
• Affected: All Windows versions with NTFS — including Windows Server 2025 used as build agents.

Critical CVEs Developer Environments Should Prioritize

Developer Patch Checklist

Quick update commands (run as admin):

CI/CD and Build Infrastructure Considerations

Windows-hosted CI runners are often deprioritized for patching because teams treat them as ephemeral — but persistent self-hosted runners on Windows Server are as exposed as any workstation. The NTFS zero-day (CVE-2026-24991) is particularly relevant here: if a build pipeline mounts disk images or processes container layer tarballs as part of artifact handling, a malicious image injected into the pipeline could trigger RCE on the build agent.

• GitHub Actions self-hosted runners on Windows: Apply Windows Update before re-queuing jobs. Microsoft-hosted runners are already patched as of today.
• Azure Pipelines self-hosted agents: Same — patch the host OS, reboot, reconnect the agent pool.
• Jenkins on Windows: Patch both the controller and any Windows build nodes. The Azure DevOps Server CVE (CVE-2026-24962) may also affect self-hosted Jenkins via shared authentication integrations.
• Docker Desktop on Windows: Relies on Hyper-V or WSL2 — patch the host Windows to close the Hyper-V guest-escape (CVE-2026-21406) before resuming container-based development.

March 2026 in Context: Patch Tuesday Trend

March 2026's 79-CVE count is the highest Patch Tuesday volume since November 2025 (84 CVEs) and continues a trend of elevated monthly patch loads driven by AI-assisted vulnerability research. Security teams using LLM-based code analysis are discovering vulnerability classes in Windows components that manual review missed — the pace of disclosure is accelerating faster than enterprise patch cycles can absorb.

• Jan 2026: 62 CVEs (3 Critical)
• Feb 2026: 71 CVEs (5 Critical, 1 zero-day)
• Mar 2026: 79 CVEs (11 Critical, 2 zero-days) ← today

The cadence reinforces the case for automated patch management — relying on manual update cycles for developer workstations creates an expanding window of exposure between each Patch Tuesday.

BleepingComputer: Full March 2026 Patch Tuesday breakdown →

Microsoft Security Response Center — Update Guide →