Patch Tuesday Jan 2026: Microsoft Fixes 114 Flaws & 3 Zero-Days

Microsoft’s January 2026 Patch Tuesday fixes a total of 114 vulnerabilities, including eight critical flaws and 106 important-severity issues across Windows components from NTFS to the Cloud Files Mini Filter Driver.

The update also introduces three zero-day vulnerabilities, two of which were publicly disclosed before a fix was available: the Agere Soft Modem Driver (CVE-2023-31096) and Secure Boot Bypass (CVE-2026-21265), with Microsoft noting the third zero-day remains under active exploitation in the wild alongside a separate critical RCE in Word and Excel flaws.

The most pressing flaw is CVE-2026-20805, an information-disclosure vulnerability in the Desktop Window Manager that an unauthenticated attacker can exploit to leak a section address from a remote ALPC port. According to the advisory, CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, with a patch deadline of 3 February 2026.

Other notable fixes include CVE-2026-20854, a critical RCE in LSASS, and multiple Office vulnerabilities (CVE-2026-20944, CVE-2026-20952, CVE-2026-20953, CVE-2026-20955, CVE-2026-20957) that could lure users into opening malicious files.