Stay ahead of critical vulnerabilities with our breakdown of January 2026 Microsoft security patches.
Published: January 13, 2026
Microsoft has released its January 2026 Patch Tuesday security updates, addressing 114 vulnerabilities across its product ecosystem. This month's update includes three zero-day vulnerabilities, with one actively exploited in the wild, making immediate deployment critical for organizations worldwide.
The January 2026 Patch Tuesday represents the first major security release of the year, featuring fixes for widespread vulnerabilities affecting Windows operating systems, Microsoft Office applications, and server components. Security teams should prioritize deployment of these updates, particularly for systems exposed to the actively exploited Desktop Window Manager vulnerability.
Key Statistics:
The most pressing threat this month is an information disclosure flaw affecting Desktop Window Manager, which Microsoft confirms is being actively exploited by attackers. The vulnerability carries a CVSS score of 5.5 and allows authenticated attackers to access sensitive information on vulnerable systems.
This vulnerability enables attackers to leak section addresses from remote ALPC ports, which threat actors likely use in the next stage of their exploit chains to achieve arbitrary code execution. While information disclosure bugs are less commonly exploited than code execution vulnerabilities, this case demonstrates how memory leaks enable reliable exploitation of subsequent vulnerabilities.
Affected Systems:
Mitigation Priority: IMMEDIATE
Microsoft certificates stored in the UEFI Key Enrollment Key and database are nearing their expiration dates, requiring updates to maintain Secure Boot functionality and prevent future system issues. While exploitation likelihood is low, failure to address this vulnerability could result in boot failures and loss of system access starting in mid-2026.
CVSS Score: 6.4
Status: Publicly disclosed, not exploited
Impact: Systems may fail to boot or receive security updates after certificate expiration
Microsoft is removing vulnerable third-party Agere Soft Modem drivers that ship natively with supported Windows operating systems. The January updates remove the following drivers:
Organizations using modem hardware dependent on these drivers should note that this hardware will no longer function in Windows following the update.
This critical vulnerability affects Windows Local Security Authority Subsystem Service with a CVSS score of 7.5, enabling authorized attackers to execute code on affected systems over a network. Successful exploitation does not require elevated privileges, though Microsoft assesses exploitation as "less likely."
Several critical remote code execution flaws affect Microsoft Office applications:
CVE-2026-20944 (Word): An out-of-bounds read vulnerability that could enable attackers to execute arbitrary code if victims open specially crafted malicious files. CVSS: 7.8
CVE-2026-20957 (Excel): An integer underflow vulnerability that could be leveraged by unauthorized attackers to execute arbitrary code, requiring victims to open malicious files. CVSS: 7.8
CVE-2026-20952, CVE-2026-20953 (Office): Both vulnerabilities carry CVSS scores of 8.4 and affect multiple Office components. Microsoft notes that the Preview Pane is an attack vector for these vulnerabilities, meaning exploitation does not require targets to open files.
Security Recommendation: Organizations concerned about Office-based attacks should consider disabling the Preview Pane feature to prevent exploitation without user interaction.
This use-after-free vulnerability could enable attackers to obtain SYSTEM privileges on affected systems, though successful exploitation requires winning a race condition. CVSS: 7.8
A heap-based buffer overflow in Windows Virtualization-Based Security Enclave could grant attackers Virtual Trust Level 2 privileges on affected systems. VTL2 represents the highest privileged level in VBS, and this marks one of the first VTL escalation bugs patched within the VBS system. CVSS: 6.7
This update advances systems to:
Key Fixes:
The update addresses a battery issue affecting devices with Neural Processing Units that caused systems to stay powered on when idle, impacting power performance.
The update resolves networking problems where mirrored networking in Windows Subsystem for Linux could fail with "No route to host" errors, preventing access to corporate resources over VPN connections even when the Windows host remained connected.
Microsoft fixed RemoteApp connection failures occurring in Azure Virtual Desktop environments.
Build: 22631.6491
Contains identical security fixes and modem driver removals as KB5074109.
Microsoft acknowledges a continuing bug from August 2025 where the password icon is not visible on the lock screen sign-in options, though the password button remains functional when hovering over the placeholder space.
For organizations still running Windows 10 under Extended Security Updates programs:
The update includes security fixes and modem driver removals identical to Windows 11 updates. Microsoft reports no known issues in this update.
Adobe released 11 bulletins addressing 25 CVEs across multiple products:
Cisco released security updates for an Identity Services Engine vulnerability with publicly available proof-of-concept exploit code.
Organizations should prepare for the Secure Boot certificate expiration in mid-2026 by ensuring systems receive and install these updates promptly. Failure to update certificates could result in boot failures starting in June 2026.
| Category | Count | Percentage |
|---|---|---|
| Elevation of Privilege | 56 | 49.6% |
| Remote Code Execution | 22 | 19.5% |
| Information Disclosure | 18 | 15.9% |
| Security Feature Bypass | 10 | 8.8% |
| Denial of Service | 6 | 5.3% |
| Spoofing | 1 | 0.9% |
Cisco Talos has released Snort rules to detect exploitation attempts, including Snort 2 rules 65498, 65499, 65663-65676, and Snort 3 rules 301344, 301368-301374.
The January 2026 Patch Tuesday introduces critical fixes that require prompt attention, particularly the actively exploited Desktop Window Manager vulnerability. Organizations should expedite testing and deployment of these updates while maintaining vigilance for signs of exploitation.
The removal of legacy modem drivers and upcoming Secure Boot certificate expiration highlight Microsoft's ongoing efforts to modernize the Windows platform and deprecate outdated components that pose security risks.
Security teams should treat this Patch Tuesday with high urgency, implementing a rapid deployment strategy for the actively exploited zero-day while following standard change management procedures for remaining updates.
Release Date: January 13, 2026
Total CVEs: 114
Critical CVEs: 8
Actively Exploited: CVE-2026-20805
Windows 11 KB Numbers: KB5074109, KB5073455
Windows 10 KB Number: KB5073724
Resources:
Next Patch Tuesday: February 11, 2026
