[Security] March 2026 Patch Tuesday: Agentic Risks

Microsoft's March 2026 Patch Tuesday addresses 83 vulnerabilities, including two critical Zero-Day exploits. The most significant technical threat is CVE-2026-26144, a zero-click exfiltration flaw in Microsoft Excel's Copilot Agent. This vulnerability allows an attacker to weaponize a malformed .xlsx file to dump the agent's memory context to a remote C2 server.

CVE-2026-26144: The "Agent Leak" Exploit

The exploit targets the Semantic Search cache used by the Copilot sidebar. By crafting a recursive macro that mimics a legitimate calculation request, attackers can bypass the Win32 AppContainer isolation. Once triggered, the agent erroneously includes the system's environment variables and NTLM hashes in its reasoning trace, which is then sent via an outbound API call.

PrintNightmare Reloaded: CVE-2026-23669

Another critical fix addresses a remote code execution (RCE) vulnerability in the Windows Print Spooler. Dubbed "PrintNightmare Reloaded," this flaw leverages a logic error in v4 printer drivers to gain SYSTEM privileges. Administrators are urged to disable the spooler on all non-printing servers immediately.