Zero-days in .NET and SQL Server, and a handful of critical RCE bugs, form the nucleus of Microsoft's March Patch Tuesday update.
The server never sees plaintext messages — it only relays encrypted payloads between clients using NaCl (Curve25519) public-key cryptography.