Microsoft Patch Tuesday security updates for January 2026 fixed actively exploited zero-day

Microsoft Patch Tuesday for January 2026 fixes 112 CVEs across Windows, Office, Azure, Edge, SharePoint, SQL Server, SMB and Windows management services, with the total rising to 114 vulnerabilities when third‑party Chromium fixes are included. Eight flaws are rated Critical and the rest Important, reflecting a sizeable start to the year for patching.

One vulnerability, tracked as CVE-2026-20805, is actively exploited in the wild and affects Windows Desktop Window Manager, where an information leak could help attackers bypass protections and enable more serious exploits; according to the advisory, the exposure is local and could disclose a section address from a remote ALPC port.

The publicly known flaws at release include CVE-2023-31096 affecting outdated Agere Soft Modem drivers, CVE-2026-21265 related to expiring Windows Secure Boot certificates, and CVE-2024-55414 affecting Motorola Soft Modem drivers, with Microsoft removing the implicated drivers in the January 2026 update. The article notes Microsoft did not share details about the attacks exploiting CVE-2026-20805.