Microsoft has issued security updates for 114 flaws, including three Zero-Day vulnerabilities (one actively exploited and two publicly disclosed) as part of the Patch Tuesday updates for January 2026.
Zero-Days Fixed
The most critical patches address three flaws already being used or exposed to the public
- Actively Exploited Zero-Day (Info Disclosure)
- CVE-2026-20805 - Desktop Window Manager Information Disclosure Vulnerability Impact: This flaw allows a local attacker to leak sensitive memory addresses from the Desktop Window Manager (DWM). While classified as "Information Disclosure," it is being used in the wild to bypass Address Space Layout Randomisation (ASLR), acting as a "stepping stone" to more dangerous code execution attacks.
- Publicly Disclosed Zero-Days (Bypass & Driver Risk)
- CVE-2026-21265 - Secure Boot Certificate Expiration Security Feature Bypass Impact: Relates to the upcoming expiration of 2011-era Secure Boot certificates. Without this patch, systems risk future boot failures or vulnerability to "bootkits" that load before the operating system.
- CVE-2023-31096 - Windows Agere Soft Modem Driver Elevation of Privilege Impact: A legacy driver vulnerability that could allow an attacker to gain SYSTEM privileges. Microsoft has opted to remove these drivers entirely in this update to neutralise the risk.
Critical Vulnerabilities to Prioritise
Beyond the zero-days, eight vulnerabilities received a "Critical" rating, with several Remote Code Execution (RCE) flaws requiring immediate attention,
- CVE-2026-20952 & CVE-2026-20953 - Microsoft Office Critical RCE - These vulnerabilities allow code execution via the Outlook Preview Pane, meaning a user does not need to open the email to be compromised.
- CVE-2026-20854 - Windows LSASS Remote Code Execution - A critical flaw in the core authentication service. Successful exploitation could allow network-level code execution on servers and workstations.
- CVE-2026-20876 - Windows VBS Enclave Elevation of Privilege - Allows an attacker to break the "Virtualization-Based Security" boundary, reaching the most trusted layers of the OS.
Vulnerabilities by Category
The January 2026 updates addressed a total of 114 flaws, categorised as follows,
- Elevation of Privilege Vulnerabilities - 57
- Remote Code Execution Vulnerabilities - 22
- Information Disclosure Vulnerabilities - 22
- Spoofing Vulnerabilities - 5
- Security Feature Bypass Vulnerabilities - 3
- Tampering Vulnerabilities - 3
- Denial of Service Vulnerabilities - 2
- Total Flaws - 114
Need Help with Patch Management?
Struggling with relentless patching?
NOCTeam can secure your environment with proactive Patch Management and Endpoint Detection and Response (EDR) services.
Contact us today at [email protected] for a free assessment of your IT systems.
Originally published on LinkedIn.