Weekly briefing

Week 12 · 16 Mar – 22 Mar 2026 UTC · assess the changes, then plan the next dates.

What to assess first

16 Mar – 22 Mar · dates to 21 Apr Check coverage

Act on3

20Mar
Security20 Mar 2026
iOS and iPadOS / macOS · 3 security records
CVE-2025-31277
19Mar
Exploited19 Mar 2026
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
CVE-2026-20131
16Mar
Exploited16 Mar 2026
Edge 146.0.3856.62: fixes CVE-2026-3909, exploited in the wild
Microsoft Edge security release notes
Related evidence (6)
- Google Skia Out-of-Bounds Write Vulnerability
  Public source · Shared CVE CVE-2026-3909
- Edge 146.0.3856.72: Chromium security fixes
  Public source · Same source page; the statements may concern different changes
- Edge 146.0.3856.59: fixes CVE-2026-3910, exploited in the wild
  Public source · Same source page; the statements may concern different changes
- Edge 145.0.3800.97: Chromium security fixes
  Public source · Same source page; the statements may concern different changes
- Edge 145.0.3800.82: Chromium security fixes
  Public source · Same source page; the statements may concern different changes
- Edge 145.0.3800.70: Chromium security fixes
  Public source · Same source page; the statements may concern different changes

Coming up8

29Mar
RetirementDue 29 Mar 2026
Retirement: Classic VMware protection scenario using ASR
30Mar
Message Center action dateDue 30 Mar 2026
MC1184996: Legacy SharePoint Online Content Delivery Network (CDN) domain to be retired—review configurationsMicrosoft 365 Message Center Archive by Merill Fernando
Same day: Message Center action date: MC1189663: Retirement of external access token for actionable messages – moving to Microsoft Entra authentication; Message Center action date: MC1226498: Retirement of the isBroadcast property for Teams Live Events in Microsoft Graph; Message Center action date: MC1234566: Outlook: retiring “Contact Masking” (hide suggested recipients) - March 31, 2026
31Mar
RetirementDue 31 Mar 2026
Retirement: 9 products
API Keys for querying Application Insights; Batch Region Retirement; Classic alerts for Azure Backup; Classic Compute Node Communication Model; Deprecation of flash-extract custom fields; Retire Require Approve Client App Conditional Access Grant; VHD and Managed Images; Windows Server 2019 on AKS…
Same day: End of support: Azure Kubernetes Service Kubernetes 1.32; End of support: Microsoft SQL Server 2012 Parallel Data Warehouse (Analytics Platform System); Message Center action date: MC1227080: Project Online retirement: Project Web App site creation and unused PWA site changes effective April 1, 2026; Message Center action date: MC1240748: Retiring the Impala connector
4Apr
End of servicingDue 4 Apr 2026
End of servicing: Dynamics 365 Business Central on-premises (Modern Policy), 2024 release wave 2, version 25.x
5Apr
Message Center action dateDue 5 Apr 2026
MC1221939: Message Trace support on Graph API is now in Public PreviewMicrosoft 365 Message Center Archive by Merill Fernando
14Apr
Patch TuesdayScheduled for 14 Apr 2026
Patch Tuesday, 14 April 2026
The second Tuesday of the month, when Microsoft releases security updates for Windows, Office, and servers.
14Apr
End of supportDue 14 Apr 2026
End of support: 10 products
Dynamics C5 2016; Dynamics NAV 2016; Microsoft Advanced Group Policy Management 4.0; Microsoft Application Virtualization 5.0; Microsoft Application Virtualization 5.1; Microsoft Application Virtualization Hosting 5.0 for Windows Desktops; Microsoft Application Virtualization Hosting 5.1 for Window…
22Mar
Message Center action dateDue 22 Mar 2026
MC1224565: Trust DigiCert Global Root G2 certificate authority to avoid Exchange Online email disruptionMicrosoft 365 Message Center Archive by Merill Fernando

Changed1

18Mar
Security18 Mar 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
CVE-2026-20963

How this list is chosen

Changes from 16 Mar 2026 – 22 Mar 2026 UTC and dates due up to 21 Apr 2026. Dates are the source's own, or labelled as the day ChangeIntel observed a change; never inferred effective dates.

Ranked by kind: exploited vulnerabilities, then up to 7 dates, open known issues, and other notable changes, with at most one entry per feed. Service incidents are on the status board; security baseline downloads, first captures of a document, and metadata-only documentation checks are left out. This is a view of retained evidence, not a reconstruction of everything known at the time.

The briefing is selective. Browse every dated change, review upcoming dates or check the period's coverage.