Microsoft Patch Tuesday January 2026: Fix 114 vulnerabilities

Microsoft is kicking off 2026 with one of the heaviest Patch Tuesdays in recent years, fixing dozens of vulnerabilities that affect the security of millions of systems worldwide.

The January 2026 Patch Tuesday brings security updates for a total of 114 vulnerabilities in Windows and related Microsoft products. Among them are three zero-day vulnerabilities, one of which is reportedly already being actively exploited by attackers, while the other two were publicly disclosed before a fix was available.

Of particular concern is the fact that eight of the issues are rated "Critical," with six involving remote code execution and two involving elevation of privilege. These are scenarios that, under certain conditions, could allow attackers to gain complete control of a system.

See also: SAP: January Security Patch Day fixes critical vulnerabilities

Microsoft Patch Tuesday: A detailed picture of the threats

The distribution of vulnerabilities clearly shows where the greatest risks are focused:

• 57 elevation of privilege vulnerabilities
• 22 remote code execution vulnerabilities
• 22 information disclosure vulnerabilities
• 5 spoofing vulnerabilities
• 3 security bypass vulnerabilities
• 2 Denial of Service vulnerabilities

It's worth noting that these numbers only refer to updates released yesterday. They do not include fixes for Microsoft Edge and Mariner, which were released earlier in the month.

The zero-day that is already being exploited by attackers

The most concerning security flaw is CVE-2026-20805, an information disclosure in the Desktop Window Manager. According to Microsoft, the flaw allows a local, authorized attacker to read sensitive memory addresses associated with remote ALPC ports.

While the company did not reveal details about how it was exploited, it confirmed that the vulnerability had already been used in real-world attacks. Its discovery was attributed to the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Security Response Center (MSRC), which underscores the severity of the threat.

Secure Boot: Countdown clock for old certificates

One of the publicly disclosed zero-days concerns Secure Boot , specifically the expiration of critical certificates issued in 2011 (CVE-2026-21265). Microsoft warns that systems that are not updated in a timely manner are at risk of bypassing Secure Boot, which could open the way for bootkits and other low-level attacks.

See also: Trend Micro patches serious vulnerabilities in Apex Central

With the January updates, the chain of trust is renewed so that verification of boot components can continue without any problems. The company had been anticipating the problem since June.

End of an era for vulnerable Agere drivers 

The third zero-day, codenamed CVE-2023-31096, concerns old third-party Agere Modem drivers. These drivers were used in elevation of privilege attacks, allowing malicious users to gain administrator privileges.

Microsoft, as previously announced, finally proceeded to completely remove agrsm64.sys and agrsm.sys from supported versions of Windows with the January 2026 cumulative update. The discovery of the vulnerabilities is attributed to Zeze and the TeamT5 team.

What does this mean for users and businesses?

The January 2026 Patch Tuesday sends a clear message: timely installation of updates is no longer optional. With zero-days actively exploited and critical gaps in fundamental security mechanisms, delay can prove disastrous, especially for enterprise environments.

Once again, Microsoft reminds us that Windows security is an ongoing struggle – and the first line of defense always starts with Windows Update.

See also: Serious bug in Broadcom software allows WiFi denial of service

Microsoft Patch Tuesday: All the vulnerabilities fixed

In the table below you can see all the vulnerabilities fixed in this month's Patch Tuesday:

Source: www.bleepingcomputer.com