Microsoft Patch Tuesday March 2026: Critical SQL & .NET Zero-Days Exploit Analysis

The March 2026 Patch Tuesday release from Microsoft is one for the history books, addressing a total of 114 vulnerabilities, including three actively exploited zero-days. Security researchers have raised alarms over critical flaws in SQL Server 2025 and the newly released .NET 10.0 runtime, which could allow for unauthenticated remote code execution (RCE) in default configurations.

CVE-2026-21740: SQL Server Memory Corruption

The most severe vulnerability addressed this month is CVE-2026-21740, a heap-based buffer overflow in the SQL Server Distributed Replay service. An attacker could exploit this by sending a specially crafted sequence of T-SQL commands that triggers a memory corruption during the parsing of execution plans.

This vulnerability is particularly dangerous because it bypasses Address Space Layout Randomization (ASLR) by utilizing a side-channel in the Intel TDX (Trust Domain Extensions) implementation on modern server CPUs. Microsoft has issued a "Critical" rating, urging all DBAs to apply the patch immediately or disable the Distributed Replay service as a temporary mitigation.

.NET 10.0: The "Ghost-In-The-Machine" Flaw

Another critical zero-day, CVE-2026-21812, targets the JIT (Just-In-Time) compiler in .NET 10.0. Dubbed "Ghost-In-The-Machine" by researchers, this flaw allows an attacker to manipulate the intermediate language (IL) emission process during the compilation of generic methods.

By providing a malicious NuGet package with specially crafted metadata, an attacker can trick the runtime into generating machine code that executes outside of the managed sandbox. This effectively grants the attacker the same permissions as the application pool identity, posing a massive risk to Azure App Service and IIS-hosted applications.

Windows Kernel & Hyper-V Escapes

Beyond SQL and .NET, the update fixes two high-profile Hyper-V escape vulnerabilities (CVE-2026-21901 and CVE-2026-21902). These allow a guest VM to write directly to the host physical memory by exploiting a race condition in the VMBus protocol. In the era of high-density AI multi-tenancy, these escapes are highly sought after by threat actors looking to hop between customer environments.

Microsoft has also strengthened the Kernel Mode Code Signing (KMCS) requirements in Windows 11 25H2 to prevent the loading of BYOVD (Bring Your Own Vulnerable Driver) attacks, which have become the preferred method for ransomware deployment in early 2026.

Mitigation Strategy for Enterprises

Given the active exploitation of these zero-days, we recommend a phased deployment starting with your DMZ-facing servers. If immediate patching isn't possible, ensure that Microsoft Defender for Endpoint is in "Block" mode for all SQL-related processes and monitor for unusual csc.exe or vbc.exe activity originating from service accounts.

Furthermore, auditing your internal NuGet feeds and implementing Package Source Mapping is no longer optional. The .NET zero-day highlights the critical importance of supply chain security in modern software development.