March Patch Tuesday visits 15 product families
Sophos, Friday, March 13th, 2026
Microsoft on Tuesday released 84 patches affecting 15 product families - including a few you've possibly never encountered. Eight of the addressed issues are considered by Microsoft to be of Critical severity, though none of those affect Windows, nor are they expected to be exploited within the next 30 days.
In addition, five of those Critical issues were in fact addressed by Microsoft in advance of Patch Tuesday itself, as we'll discuss below. Twenty-two have a CVSS base score of 8.0 or higher, including one with a 9.8 base score. None are known to be under active exploit in the wild, but two are publicly disclosed so far.
At patch time, six CVEs are judged more likely to be exploited in the next 30 days by the company's estimation. Various of this month's issues are amenable to direct detection by Sophos protections, and we include information on those in the usual table below.