SECURITYCRITICALCVE-2026-20805

Microsoft January 2026 Patch Tuesday: 114 Flaws Fixed, One

Microsoft's first security update of 2026 addresses 114 vulnerabilities including three zero-days. One flaw is actively exploited in the wild with CISA...

Security Team

Threat Intelligence

January 14, 2026
3 min read
Microsoft January 2026 Patch Tuesday: 114 Flaws Fixed, One

Actively exploited

Reported as exploited in the wild (e.g. CISA KEV). Patch or mitigate immediately.

Affected Products

  • Windows 10
  • Windows 11
  • Windows Server 2019/2022
  • Microsoft Office
  • Microsoft Excel

Microsoft January 2026 Patch Tuesday: Critical Updates Required

Microsoft kicked off 2026 with a significant Patch Tuesday release, addressing 114 security vulnerabilities across its product portfolio. Of particular concern is one actively exploited zero-day that CISA has added to its Known Exploited Vulnerabilities (KEV) catalog.

At a Glance

MetricCount
Total Vulnerabilities114
Critical Severity8
Important Severity106
Zero-Days3
Actively Exploited1

Actively Exploited Zero-Day

CVE-2026-20805 - Desktop Window Manager Information Disclosure

The most critical issue this month is CVE-2026-20805, an information disclosure vulnerability in the Desktop Window Manager (DWM) that is being actively exploited in the wild.

  • CVSS Score: 5.5
  • Attack Vector: Local
  • Privileges Required: Low
  • User Interaction: None

CISA has mandated that all federal agencies apply this fix by February 3, 2026.

Critical Remote Code Execution Flaws

Six critical RCE vulnerabilities were patched affecting core Microsoft products:

CVEProductCVSS
CVE-2026-20854Microsoft Excel8.8
CVE-2026-20944Microsoft Office8.8
CVE-2026-20952Windows LSASS9.8
CVE-2026-20953Windows LSASS9.8
CVE-2026-20955Microsoft Office8.8
CVE-2026-20957Microsoft Excel8.8

Windows LSASS Vulnerabilities

The LSASS (Local Security Authority Subsystem Service) flaws are particularly concerning as they could allow remote attackers to execute arbitrary code with SYSTEM privileges. Organizations should prioritize these patches.

Affected Systems:
- Windows Server 2019
- Windows Server 2022
- Windows 10 (all supported versions)
- Windows 11 (all supported versions)

Other Notable Vulnerabilities

CVE-2026-20876 - VBS Enclave Privilege Escalation

A critical privilege escalation flaw in Windows Virtualization-Based Security (VBS) Enclave could enable attackers to obtain Virtual Trust Level 2 (VTL2) privileges.

  • CVSS Score: 6.7
  • Impact: Subvert security controls, bypass Credential Guard

CVE-2026-21265 - Secure Boot Bypass

A security feature bypass affecting Windows Secure Boot relies on certificates expiring in June and October 2026. Organizations should plan for certificate rotation.

Legacy Driver Removals

Microsoft announced the removal of vulnerable Agere Soft Modem drivers:

  • agrsm64.sys
  • agrsm.sys

These drivers contained exploitable vulnerabilities and have been blocklisted.

Recommended Actions

  1. Immediate: Apply CVE-2026-20805 patch (actively exploited)
  2. High Priority: Patch LSASS RCE vulnerabilities (CVE-2026-20952, CVE-2026-20953)
  3. Standard: Deploy remaining Critical and Important updates
  4. Plan: Prepare for Secure Boot certificate rotation

Patch Deployment

# Check for updates via PowerShell
Get-WindowsUpdate -MicrosoftUpdate
 
# Install all security updates
Install-WindowsUpdate -AcceptAll -AutoReboot

References

Last updated: January 14, 2026