# Microsoft Office RCE via Preview Pane (CVE-2026-26110, CVE-2026-26113) — March 2026 Patch Tuesday

> Two Critical remote code execution vulnerabilities in Microsoft Office (CVE-2026-26110 type confusion, CVE-2026-26113 untrusted pointer dereference) allow attackers to execute arbitrary code via the Preview Pane without requiring users to open malicious documents. March 2026 Patch Tuesday also addresses a Critical zero-click Excel Copilot Agent data exfiltration flaw (CVE-2026-26144), two publicly disclosed zero-days, and six privilege escalation vulnerabilities rated more likely to be exploited.

- **Published:** 2026-03-11T12:00:00Z
- **Last reviewed:** 2026-03-11T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0211
- **ID:** TL-2026-0211
- **Severity:** CRITICAL (CVSS 8.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-26110, CVE-2026-26113, CVE-2026-26144, CVE-2026-21262, CVE-2026-26127, CVE-2026-23668, CVE-2026-24289, CVE-2026-24291, CVE-2026-24294, CVE-2026-25187, CVE-2026-26132, CVE-2026-23669, CVE-2026-21536, CVE-2026-26125, CVE-2026-23651, CVE-2026-26124, CVE-2026-26122

## Description

Microsoft’s March 2026 Patch Tuesday, released March 11, 2026, addresses 83 vulnerabilities across Windows, Microsoft Office, Azure, SQL Server, .NET, and Chromium-based Edge. Eight vulnerabilities are rated Critical and 75 rated Important. No vulnerabilities were actively exploited at time of release, but two were publicly disclosed zero-days.

The headline threats are CVE-2026-26110 and CVE-2026-26113, both Critical remote code execution vulnerabilities in Microsoft Office exploitable through the Preview Pane. CVE-2026-26110 is a type confusion flaw (CWE-843) caused by access to a resource using an incompatible type, where Office incorrectly handles object types and mistreats a resource as an incompatible type. Attackers craft documents containing malformed objects that cause type confusion, corrupt memory, and enable code execution. CVE-2026-26113 is an untrusted pointer dereference flaw (CWE-822) where Microsoft Office improperly handles memory pointers, allowing manipulation of memory access. Both carry a CVSS score of 8.4 with local attack vector, low complexity, no privileges required, and no user interaction needed. The Preview Pane serves as the attack vector for both, meaning users can be compromised simply by previewing a malicious document in Outlook, Windows Explorer, or other applications that render document previews. Critically, hiding the Preview Pane in Outlook may not fully mitigate these attacks. Zero Day Initiative’s Dustin Childs warns these Preview Pane vulnerabilities continue appearing regularly and “it’s just a matter of time until they start appearing in active exploits.”

CVE-2026-26144 is a Critical information disclosure vulnerability in Microsoft Excel (CVSS 7.5) caused by improper neutralization of input during web page generation (cross-site scripting). What makes this vulnerability exceptional is its ability to weaponize Copilot Agent mode: an attacker can exploit the XSS flaw to cause Copilot Agent to exfiltrate data via unintended network egress, enabling a zero-click information disclosure attack. No user interaction or privileges are needed. This represents an emerging attack pattern where AI assistant features amplify the impact of traditional web vulnerabilities.

Two publicly disclosed zero-days were patched: CVE-2026-21262, an elevation of privilege vulnerability in SQL Server (CVSS 8.8) caused by improper access control that enables attackers to gain SQL sysadmin privileges; and CVE-2026-26127, a denial of service vulnerability in .NET 9.0 and 10.0 (CVSS 7.5) caused by an out-of-bounds read.

Six privilege escalation vulnerabilities were flagged by Microsoft as “more likely to be exploited”: CVE-2026-23668 (Windows Graphics Component), CVE-2026-24289 (Windows Kernel, use-after-free, SYSTEM access), CVE-2026-24291 (Windows Accessibility Infrastructure ATBroker.exe), CVE-2026-24294 (Windows SMB Server), CVE-2026-25187 (Winlogon), and CVE-2026-26132 (Windows Kernel, use-after-free). Additionally, CVE-2026-23669 is a Windows Print Spooler RCE (CVSS 8.8) caused by a use-after-free flaw similar to PrintNightmare, allowing SYSTEM-level code execution.

Other Critical vulnerabilities include CVE-2026-21536 (Devices Pricing Program RCE, CVSS 9.8), CVE-2026-26125 (Payment Orchestrator EoP, CVSS 8.6), CVE-2026-23651 and CVE-2026-26124 (Azure Container Instances Confidential Containers EoP, CVSS 6.7), and CVE-2026-26122 (ACI Confidential Containers Information Disclosure, CVSS 6.5).

---

**Revalidated on 2026-03-12**

One day after initial disclosure, CVE-2026-26110 and CVE-2026-26113 remain unpatched in many environments and have not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No confirmed active exploitation in the wild has been observed as of March 12, 2026. However, the Zero Day Initiative has warned that exploitation 'could happen soon', noting these Preview Pane RCE bugs continue a concerning trend across recent Patch Tuesdays.

Cisco Talos has released Snort detection rules (SIDs 66089-66092, 66096, 66097, 66101-66104; Snort 3: 301442-301446) to detect exploitation attempts targeting these vulnerabilities. There are unverified reports of proof-of-concept exploit code circulating in underground forums, which would significantly accelerate the timeline to active exploitation.

Microsoft recommends the following interim mitigations for organizations unable to patch immediately: (1) disable the Preview Pane in Windows Explorer and Outlook, (2) enable Attack Surface Reduction (ASR) rules that block Office applications from creating child processes and from injecting code into other processes, and (3) restrict opening of Office files from untrusted sources.

Additionally, CVE-2026-26144 (the Excel Copilot Agent data exfiltration flaw) has been further characterized by The Register and security researchers as a cross-site scripting (XSS) combined with indirect prompt injection attack chain, where a crafted Excel document can cause Copilot Agent mode to exfiltrate data via unintended network egress in a zero-click scenario -- a novel attack class targeting AI-integrated Office features.

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1212 Exploitation for Credential Access
- T1005 Data from Local System
- T1114 Email Collection
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1499 Endpoint Denial of Service
- T1137 Office Application Startup
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol

## Sources

- [Microsoft Security Response Center - CVE-2026-26110](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26110)
- [Zero Day Initiative — The March 2026 Security Update Review](https://www.thezdi.com/blog/2026/3/10/the-march-2026-security-update-review)
- [The Register: Critical Microsoft Excel bug weaponizes Copilot Agent](https://www.theregister.com/2026/03/10/zeroclick_microsoft_info_disclosure_bug/)
- [Malwarebytes: March 2026 Patch Tuesday fixes two zero-day vulnerabilities](https://www.malwarebytes.com/blog/news/2026/03/march-2026-patch-tuesday-fixes-two-zero-day-vulnerabilities)
- [BleepingComputer: Microsoft March 2026 Patch Tuesday fixes 2 zero-days, 79 flaws](https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2026-patch-tuesday-fixes-2-zero-days-79-flaws/)
- [CyberScoop: Microsoft Patch Tuesday March 2026](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/)
- [Tenable: March 2026 Microsoft Patch Tuesday](https://www.tenable.com/blog/microsofts-march-2026-patch-tuesday-addresses-83-cves-cve-2026-21262-cve-2026-26127)
- [Qualys: Microsoft and Adobe Patch Tuesday March 2026 Security Update Review](https://blog.qualys.com/vulnerabilities-threat-research/2026/03/10/microsoft-patch-tuesday-march-2026-security-update-review)
- [Cisco Talos: Microsoft Patch Tuesday March 2026 Snort rules](https://blog.talosintelligence.com/microsoft-patch-tuesday-march-2026/)
- [CSO Online: March Patch Tuesday — Three high severity holes in Microsoft Office](https://www.csoonline.com/article/4143232/march-patch-tuesday-three-high-severity-holes-in-microsoft-office.html)
- [Help Net Security: Microsoft patches 80+ vulnerabilities, six flagged as more likely to be exploited](https://www.helpnetsecurity.com/2026/03/11/march-2026-patch-tuesday/)
- [Lansweeper: Microsoft Patch Tuesday March 2026](https://www.lansweeper.com/blog/patch-tuesday/microsoft-patch-tuesday-march-2026/)
- [SANS ISC: Microsoft Patch Tuesday March 2026](https://isc.sans.edu/diary/rss/32782)
- [CybersecurityNews: Microsoft Patch Tuesday March 2026](https://cybersecuritynews.com/microsoft-patch-tuesday-march-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0211