Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited

Microsoft released its first security update for 2026, addressing 114 Windows flaws in January Patch Tuesday, with one vulnerability actively exploited in the wild. Of the flaws, eight are rated Critical and 106 Important, with 58 classified as privilege escalation, 22 information disclosure, 21 remote code execution, and five spoofing flaws.

The in-the-wild exploited item is CVE-2026-20805, an information-disclosure flaw in Desktop Window Manager, and its discovery was credited to the Microsoft Threat Intelligence Center (MTIC) and Microsoft Security Response Center (MSRC), according to MTIC and MSRC. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating Federal Civilian Executive Branch agencies to apply fixes by 3 February 2026.

The update also follows prior Edge browser fixes from December 2025, and Microsoft notes the vulnerability could expose a section address from a remote ALPC port, a memory region used by Windows components. Microsoft also highlighted ongoing Secure Boot certificate expirations (CVE-2026-21265) expected to affect firmware signing checks, with guidance to update certificates ahead of June 2026.