Microsoft Fixes 114 Windows Flaws in January 2026 Patch, Including One Actively Exploited

Key Findings

Microsoft released its first security update for 2026, addressing 114 security flaws
8 vulnerabilities were rated Critical, and 106 were rated Important in severity
The update includes 58 privilege escalation, 22 information disclosure, 21 remote code execution, and 5 spoofing flaws
The update marks the third-largest January Patch Tuesday after January 2025 and January 2022
2 previously disclosed zero-day vulnerabilities were also addressed

Microsoft regularly releases monthly security updates, known as Patch Tuesday, to address vulnerabilities in its software
The January 2026 Patch Tuesday update is the first for the new year, addressing a wide range of issues across the Windows ecosystem

CVE-2026-20805 (Information Disclosure)

This vulnerability in the Desktop Window Manager (DWM) allows an unauthenticated attacker to disclose sensitive information locally
The disclosed information includes a section address from a remote ALPC port, which could be used to undermine security defenses
This vulnerability is actively being exploited in the wild, according to Microsoft

CVE-2026-21265 (Secure Boot Bypass)

This security feature bypass flaw could allow an attacker to undermine the Secure Boot mechanism, which ensures firmware modules come from a trusted source
Microsoft is urging customers to update Secure Boot certificates before the current ones expire in June 2026

Other Notable Vulnerabilities

Several critical Remote Code Execution (RCE) flaws were patched in Microsoft Office applications, including Word and Excel
A critical RCE vulnerability was addressed in the Windows Local Security Authority Subsystem Service (LSASS), which handles authentication and sensitive credentials

Security teams should prioritize the deployment of this security update, especially for the actively exploited CVE-2026-20805 vulnerability
Organizations should also review their Secure Boot certificate management to ensure systems are updated before the June 2026 expiration
Regular patching and security hygiene practices are crucial to mitigate the risks posed by these vulnerabilities

https://thehackernews.com/2026/01/microsoft-fixes-114-windows-flaws-in.html
https://securityonline.info/patch-tuesday-jan-2026-microsoft-fixes-114-flaws-3-zero-days/
https://cyberscoop.com/microsoft-patch-tuesday-january-2026/
https://www.linkedin.com/pulse/microsoft-january-2026-patch-tuesday-fixes-100-mwcre
https://cyberinsider.com/microsoft-fixes-114-flaws-in-years-first-windows-11-patch-tuesday/
https://www.clearphish.ai/news/microsoft-january-2026-patch-tuesday-fixes-114-flaws-zero-days
https://www.anoopcnair.com/2026-january-kb5074109-kb5073455-windows-11/