Out of the 114 fixed issues, eight are rated as Critical severity, while 106 are rated Important. The majority of these problems, 58 in total, are privilege escalation vulnerabilities, which allow attackers to gain higher-level access to systems. The update also addresses 22 information disclosure issues, 21 remote code execution vulnerabilities, and five spoofing weaknesses. According to data from Fortra, this is the third-largest January security update on record, smaller only than the January 2025 and January 2022 releases.
Microsoft also fixed two security issues in its Edge browser since December 2025. These include a low-severity spoofing problem in Edge for Android (CVE-2025-65046, CVSS score 3.1) and a high-severity policy enforcement flaw in Chromium’s WebView component (CVE-2026-0628, CVSS score 8.8).
The Actively Exploited Vulnerability
The vulnerability being exploited in the wild is CVE-2026-20805 (CVSS score 5.5), an information disclosure flaw in the Desktop Window Manager (DWM) component. Microsoft’s Threat Intelligence Center discovered this issue and reported it through the Microsoft Security Response Center. When successfully exploited, this vulnerability allows an attacker who has already logged into the system to access sensitive memory information—specifically, a memory address related to a remote Advanced Local Procedure Call (ALPC) port.
Microsoft explained that this vulnerability exposes memory addresses used for communication between different processes in Windows. While Microsoft hasn’t released public information about how the attacks are happening, which systems are being targeted, or who the attackers are, security experts note that these types of information leaks are typically used as part of larger, multi-step attacks.
Security researchers point out that DWM is an especially appealing target for attackers because it runs with high privileges and is present on all Windows systems. According to Rapid7 security researcher Adam Barnett, DWM handles all graphical display on Windows, creating a large attack surface. In this case, the vulnerability leaks an ALPC port section address, which helps attackers bypass modern memory protection features.
This isn’t the first time DWM has been exploited. In May 2024, Microsoft patched CVE-2024-30051 (CVSS score 7.8), a privilege escalation vulnerability that was exploited by multiple attacker groups in campaigns involving QakBot malware and other threats with at least 20 vulnerabilities patched in this component since 2022.
The CVE-2026-20805 can be used to weaken Address Space Layout Randomization (ASLR), a security feature that randomizes memory locations. By revealing where things are located in memory, attackers can combine this vulnerability with another code execution flaw, making their attacks much more reliable and turning unstable exploits into dependable, weaponized tools.
Because this vulnerability is being actively exploited, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20805 to its Known Exploited Vulnerabilities catalog. Federal government agencies must apply the security patch by February 3, 2026.
Other Important Security Issues
Another significant issue in this update is CVE-2026-21265 (CVSS score 6.4), a security feature bypass affecting how Secure Boot handles certificate expiration. Attackers could exploit this to undermine the trust system that ensures only properly signed firmware and boot components can run when a computer starts up.
Microsoft previously announced plans to phase out three old Secure Boot certificates from 2011, starting in June 2026, and encouraged customers to upgrade to the 2023 replacement certificates. These updates affect key exchange keys (KEK), Windows boot loader signing certificates, and certificates for third-party UEFI firmware and option ROM signing. Organizations that don’t update these certificates may experience secure boot failures or weakened boot-time security.
The January update also removes outdated Agere Soft Modem drivers (agrsm64.sys and agrsm.sys) that come with Windows. These drivers have a long-standing local privilege escalation vulnerability (CVE-2023-31096, CVSS score 7.8) that allows attackers to gain SYSTEM-level privileges—the highest level of access on Windows. This follows Microsoft’s October 2025 removal of another Agere driver (ltmdm64.sys) after it was exploited in real-world attacks (CVE-2025-24990).
One of the highest-risk issues in this release is CVE-2026-20876 (CVSS score 6.7), a privilege escalation vulnerability in Windows Virtualization-Based Security (VBS) Enclave. Successfully exploiting this flaw allows attackers to gain Virtual Trust Level 2 (VTL2) privileges, which means breaking through one of Windows’ strongest security boundaries. While attackers need elevated access to exploit this vulnerability, gaining VTL2 privileges lets them disable advanced security protections, establish persistent access that’s hard to remove, and avoid detection by security software.
Security experts warn that vulnerabilities affecting virtualization-based security fundamentally undermine trust in Windows’ security architecture. As Action1 researchers noted, attackers who already have some access to a system could use this flaw to defeat protections specifically designed to protect the Windows kernel itself, making quick patching essential for high-security environments.
Why FileDNA Still Matters
While applying Microsoft’s security updates remains one of the most important defensive measures, many successful attacks never begin by directly exploiting an unpatched vulnerability. Instead, attackers typically rely on phishing emails, malicious documents, archive files, ISO and VHDX images, JavaScript, PowerShell, or VBScript-based downloaders to establish an initial foothold. Once that first-stage payload executes, it can download additional malware or exploit local privilege-escalation vulnerabilities—such as those addressed in this month’s Patch Tuesday—to obtain SYSTEM-level privileges and fully compromise the endpoint.
This is where FileDNA™ CADR (Content Analysis, Disarm, and Reconstruction) complements traditional patch management. Rather than detecting malware after execution, FileDNA analyzes the actual binary structure of incoming files, identifies embedded active content, malicious scripts, and suspicious objects, removes those components, and reconstructs a safe version before the file reaches the user. By preventing the initial execution of weaponized files, organizations can significantly reduce the likelihood that attackers will ever reach the stage where Windows privilege-escalation or remote code execution vulnerabilities become useful.
This layered approach is particularly valuable during the period between vulnerability disclosure and complete enterprise-wide patch deployment. Even well-managed organizations require time to validate and install updates across thousands of systems. FileDNA helps reduce exposure during that window by stopping many file-based intrusion attempts before attackers can gain the foothold needed to exploit newly disclosed Windows vulnerabilities. Rather than replacing Patch Tuesday, it strengthens Microsoft’s security updates by addressing an earlier phase of the attack chain—the initial malicious file delivery that precedes privilege escalation, credential theft, ransomware deployment, and other post-compromise activity.
References
- Microsoft Security Response Center, CVE-2026-20805 Desktop Window Manager Information Disclosure Vulnerability advisory.
- National Vulnerability Database, CVE-2026-20805 detail, affected configurations and CVSS metrics.
- Cybersecurity and Infrastructure Security Agency, CISA Adds One Known Exploited Vulnerability to Catalog, January 13, 2026.
- Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog.
- Rapid7, Patch Tuesday January 2026, analysis by Adam Barnett.
- Tenable, Microsoft’s January 2026 Patch Tuesday Addresses 113 CVEs (CVE-2026-20805), commentary by Satnam Narang.
- The Hacker News, Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited.
- BleepingComputer, Microsoft January 2026 Patch Tuesday Fixes 3 Zero-Days, 114 Flaws.
- Action1, Patch Tuesday commentary on Windows VBS Enclave and DWM vulnerabilities, remarks by Jack Bicer.
- Security Affairs, Microsoft Patch Tuesday Security Updates for January 2026 Fixed Actively Exploited Zero-Day.
- Microsoft Security Response Center, CVE-2024-30051 Desktop Window Manager Core Library Elevation of Privilege Vulnerability advisory (May 2024).
- National Vulnerability Database, CVE-2023-31096 Agere Modem driver local privilege escalation vulnerability.
- National Vulnerability Database, CVE-2025-24990 Agere Modem driver vulnerability detail.