Microsoft March Security Updates for Active Directory and SQL Server Privilege Escalation Flaws

Microsoft disclosed multiple privilege escalation vulnerabilities in core enterprise products, including Active Directory Domain Services and SQL Server, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. CVE-2026-25177 affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate SPN or UPN values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to NTLM where enabled, and ultimately enabling escalation to SYSTEM-level control in affected environments.

Microsoft also disclosed CVE-2026-21262 in SQL Server, an Important-rated flaw with a CVSS 8.8 score that allows an authenticated attacker to elevate privileges to sysadmin, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as less likely and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about ADCS ESC1, Cisco SD-WAN Manager, and n8n concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.