Notifications
Clear all
Topic starter
19/08/2026 3:57 pm
TL;DR: March 2026 Patch Tuesday includes 79 CVEs, three critical flaws, and a zero-click Excel issue that could let Copilot disclose sensitive data, according to Expel, while attackers are still exploiting a five-year-old WordPress plugin flaw to install cryptomining software. The pattern is not patch volume alone but how quickly exposed software, elevated privileges, and AI-assisted data paths turn into operational risk.
NHIMG editorial — based on content published by Expel: Patch Tuesday coverage for March 10, 2026 and active exploitation of an abandoned WordPress plugin
By the numbers:
- This month’s Patch Tuesday release includes 79 new CVEs, including three classified critical.
Questions worth separating out
Q: What breaks when unsupported software stays on a live production system?
A: Unsupported software creates a permanent exposure window because the code remains reachable even after the maintainer has stopped fixing flaws.
Q: Why do privilege escalation flaws in database platforms matter so much?
A: Privilege escalation in a database is not just a local bug.
Q: How do security teams know whether Patch Tuesday exposure is actually shrinking?
A: Look beyond patch counts and measure how long critical flaws remain reachable in production, how quickly high-risk systems are remediated, and whether privileged paths are monitored for abuse.
Practitioner guidance
- Prioritise flaws that can cross trust boundaries Rank this Patch Tuesday release by whether each issue can lead to privilege escalation, unauthorised execution, or data disclosure.
- Review AI assistant data paths for disclosure risk Map what Copilot can read, process, and return from office documents and connected services.
- Remove unsupported plugins from live WordPress estates Delete abandoned extensions like Kaswara immediately, then inspect upload directories such as wp-content/uploads/kaswara/fonts_icon/ for executable files.
What's in the full article
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- Walkthroughs of the SQL Server, .NET, and Excel vulnerability mechanics in the March 2026 release
- The specific exploit path used in the abandoned WordPress plugin case, including upload handling and execution flow
- Indicators and file-system checks for finding suspicious PHP files in WordPress upload directories
- Context on why the Copilot-linked Excel issue changes the disclosure model for document workflows
👉 Read Expel's analysis of March 2026 Patch Tuesday and active WordPress exploitation →
Patch Tuesday’s zero-click and privilege flaws: what teams need to know?
Explore further
19/08/2026 4:35 pm
Patch volume is a governance signal, not an operating plan. Seventy-nine CVEs in a single release tells teams that prioritisation, not raw patch throughput, is the control that matters. The challenge is separating exposures that threaten privilege boundaries from those that mainly affect availability. In practice, security leaders should rank fixes by the identity or execution paths they can open, not by headline count alone.
A few things that frame the scale:
- Ultimate Guide to NHIs reports that 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Our research also shows that only 5.7% of organisations have full visibility into their service accounts, which makes orphaned access and stale credentials harder to spot.
A question worth separating out:
Q: Who is accountable when a zero-click disclosure path exposes sensitive data?
A: Accountability usually sits across application ownership, identity governance, and data protection teams because the failure spans document processing, access entitlement, and information disclosure. Where an AI assistant can surface data from hidden paths, organisations must review who approved access, who monitored the workflow, and who owns the risk acceptance decision.
👉 Read our full editorial: Patch Tuesday’s 79 flaws expose identity and runtime risk
