Microsoft released its first security updates for 2026, addressing 114 vulnerabilities across its products. The January Patch Tuesday release includes fixes for three zero-day vulnerabilities, with one already actively exploited by attackers. This substantial update also resolves 12 critical flaws that could allow remote code execution or elevate privileges on affected systems.^[1][2][3][4] ### Urgent Zero-Day Exploitation The most pressing concern in this month's updates is CVE-2026-20805, an information disclosure vulnerability in the Windows Desktop Window Manager. Attackers are actively exploiting this zero-day flaw in the wild. It allows local attackers with basic user privileges to access sensitive system memory addresses. Security experts say this information can help attackers bypass security protections or enable more sophisticated, multi-stage attacks.^{[5][6][7][8][9][1][2][3][10][11][4]} The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-20805 to its Known Exploited Vulnerabilities Catalog. CISA urges organizations to patch this vulnerability by February 3, 2026.^[4] Dustin Childs of the Zero Day Initiative noted that "it's a bit unusual to see an information disclosure bug exploited in the wild, but that's what we have here."^[7] He added that threat actors likely use the leaked memory addresses in the next stage of their exploit chain, possibly to gain arbitrary code execution.^[7] ### Other Zero-Days and Critical Flaws The January Patch Tuesday also fixes two other publicly disclosed zero-day vulnerabilities. CVE-2026-21265 is a security feature bypass vulnerability affecting Windows Secure Boot. This flaw relates to Secure Boot certificates issued in 2011 that are set to expire in June and October 2026. Systems not updated with the new 2023 certificates could face disruptions.^{[6][8][9][1][3][11][4]} Chris Goettl, vice-president of product management at Ivanti, called this a "ticking time bomb for enterprise security" if not addressed promptly.^[8] The third zero-day, CVE-2023-31096, is an elevation of privilege vulnerability in the Windows Agere Soft Modem Driver. Despite its older CVE designation, Microsoft included a fix in this month's cumulative updates. The company's solution involves removing the impacted drivers, agrsm64.sys and agrsm.sys, from systems.^{[6][8][1][2][3][4]} Beyond the zero-days, Microsoft addressed 12 critical vulnerabilities this month. These critical issues primarily involve remote code execution (RCE) and elevation of privilege (EoP) flaws.^[1][2][3] Many affect widely used products like Windows and Microsoft Office.^{[6][7][8][2][12][13]} ### Broad Impact Across Microsoft Products Several critical remote code execution vulnerabilities impact Microsoft Office applications. These include flaws in Microsoft Word (CVE-2026-20944) and Microsoft Excel (CVE-2026-20952, CVE-2026-20953, CVE-2026-20955, CVE-2026-20957).^{[6][14][7][9][1][2][12][10][4]} Exploitation of these Office vulnerabilities typically requires user interaction, such as opening a malicious file. For some, the Outlook Preview Pane can serve as an attack vector, allowing code execution without further user action.^[7][10] Nick Carroll, cyber incident response manager at Nightwing, warned that Office-related vulnerabilities "can quickly become popular with threat actors."^[8] Other critical vulnerabilities include CVE-2026-20854, a remote code execution flaw in the Windows Local Security Authority Subsystem Service (LSASS). This use-after-free vulnerability is exploitable over networks, posing a significant risk to enterprises.^{[6][9][1][2][4]} Elevation of privilege issues also affect the Windows Graphics Component (CVE-2026-20822) and Windows Virtualization-Based Security (VBS) Enclave (CVE-2026-20876), both potentially granting attackers SYSTEM-level access.^[6][7][9][2] Mike Walters, president and co-founder of Action1, stated that the VBS Enclave vulnerability "poses a serious risk for organizations relying on VBS to protect credentials, secrets and sensitive workloads."^[7] The 114 vulnerabilities addressed span various categories. Elevation of privilege flaws account for 57 patches, while remote code execution and information disclosure vulnerabilities each comprise 22 fixes. Additional patches cover spoofing, security feature bypass, denial of service, and tampering issues.^[1][2][4] ### Call to Action for Users Microsoft's January 2026 Patch Tuesday updates affect a wide array of products, including Windows 10, Windows 11, various Windows Server versions, Microsoft Office suites, Azure components, and SQL Server.^{[6][7][8][2][12][13]} Security teams and individual users should prioritize applying these updates immediately to protect their systems from potential exploitation. Organizations should start with internet-facing systems and test updates in staging environments to prevent regressions.^[1] The active exploitation of one zero-day vulnerability underscores the urgency of this month's patching cycle.^{[5][6][7][8][9][1][2][3][10][11][4]}

AI Insights Hub