Microsoft Starts 2026 With a Bang: A Freshly Exploited Zero-Day

Security teams are facing a busier January Patch Tuesday, with Microsoft’s update addressing 112 CVEs—roughly double December’s tally. The patch bundle includes a freshly exploited zero-day in Desktop Window Manager, CVE-2026-20805, with a CVSS of 5.5, which is already being used to leak memory address information to aid follow-on attacks.

Microsoft also flagged eight vulnerabilities as more likely to be exploited, including two remote code execution flaws in Windows NTFS, CVE-2026-20840 and CVE-2026-20922, both CVSS 7.8, which could allow arbitrary code execution. Among the six remaining elevation-of-privilege bugs are CVE-2026-20816, CVE-2026-20817, CVE-2026-20820, CVE-2026-20843, CVE-2026-20860 and CVE-2026-20871, each rated 7.8.

As the critique around the two high-severity flaws grows, some researchers caution that public details could accelerate exploitation, according to Satnam Narang, senior staff research engineer at Tenable.