Full Report
Microsoft has released its monthly security update for January 2026, which includes 112 vulnerabilities affecting a range of products, including 8 that Microsoft marked as “critical”.
Analysis Summary
This summary focuses on the critical and actively exploited vulnerabilities detailed in the January 2026 Microsoft Security Update release.
---
# Vulnerability: Critical Flaws in Microsoft Windows Components, Office, and LSASS (Jan 2026)
## CVE Details
* **CVE ID:** CVE-2026-20805
* **CVSS Score:** Not explicitly provided for this CVE in the text, but it is classified as **"Important"** and **Exploited in the Wild**.
* **CWE:** Not explicitly available.
*The summary also details several **Critical** vulnerabilities, including:*
| CVE ID | Severity | Score (CVSS 3.1) | Type |
| :--- | :--- | :--- | :--- |
| CVE-2026-20822 | Critical | 7.8 | Elevation of Privilege (EoP) |
| CVE-2026-20854 | Critical | 7.5 | Remote Code Execution (RCE) |
| CVE-2026-20876 | Critical | 6.7 | Elevation of Privilege (EoP) |
| CVE-2026-20944 | Critical | 7.8 | Remote Code Execution (RCE) |
| CVE-2026-20952 | Critical | 8.4 | Remote Code Execution (RCE) |
| CVE-2026-20953 | Critical | 8.4 | Remote Code Execution (RCE) |
| CVE-2026-20955 | Critical | 7.8 | Remote Code Execution (RCE) |
| CVE-2026-20957 | Critical | Not fully provided | Remote Code Execution (RCE) |
## Affected Systems
* **Products:** Microsoft Windows (LSASS, Graphic Component, VBS Enclave, Installer, Error Reporting Service, Common Log File System Driver, NTFS, RRAS, Ancillary Function Driver for WinSock, Desktop Windows Manager), Microsoft Word, Microsoft Excel, Microsoft Office.
* **Versions:** Not specified in the summary, but the updates apply to all affected products listed above.
* **Configurations:** Varies by CVE. For example, file manipulation required for Office/Word RCEs; local access required for VBS EoP.
## Vulnerability Description
Microsoft released 112 total vulnerabilities. Key flaws identified include:
* **RCE in LSASS (CVE-2026-20854):** Allows an authorized attacker to execute code over a network without requiring elevated privileges.
* **EoP in Windows Graphic Component (CVE-2026-20822):** A Use-After-Free (UAF) bug that could lead to SYSTEM privileges, contingent on winning a race condition.
* **EoP in VBS Enclave (CVE-2026-20876):** A heap-based buffer overflow leading to Virtual Trust Level 2 (VTL2) privileges for local attackers.
* **RCE in MS Word (CVE-2026-20944):** Out-of-bounds read requiring the victim to open a malicious file.
* **RCE in MS Office (CVE-2026-20952, CVE-2026-20953):** User-after-free conditions requiring user interaction (opening a file or running an application).
* **RCE in MS Excel (CVE-2026-20955, CVE-2026-20957):** Linked to untrusted pointer reference (20955) and integer underflow (20957), requiring victims to open a malicious file.
## Exploitation
* **Status:** **CVE-2026-20805 ("Important") is being exploited in the wild.** All 8 "Critical" vulnerabilities are currently assessed by Microsoft as "less likely" to be exploited, and none have been publicly disclosed (though this assessment can change).
* **Complexity:** Varies. EoP requiring a race condition (20822) suggests medium/high complexity, while network RCE without privileges (20854) suggests lower complexity for the initial exploit payload delivery.
* **Attack Vector:** Network, Local, and User Interaction (depending on the specific CVE).
## Impact
* **Confidentiality:** High (due to RCE vulnerabilities).
* **Integrity:** High (due to RCE and EoP vulnerabilities leading to SYSTEM/VTL2 privileges).
* **Availability:** Potential impact due to code execution, though not explicitly stated as the primary impact for these flaws.
## Remediation
### Patches
* Microsoft has released the **January 2026 Security Updates** addressing all 112 identified vulnerabilities. Users should apply these updates immediately, prioritizing those fixing RCE and actively exploited flaws.
* *Specific patch versions are not detailed in this summary but are available on Microsoft’s update guide.*
### Workarounds
* No temporary workarounds were specified in the provided text, indicating immediate patching is the necessary action.
## Detection
* **Indicators of Compromise (IoCs):** Not listed explicitly, but network connections or suspicious process behavior related to the exploitation of LSASS or VBS components are potential indicators.
* **Detection Methods and Tools:**
* Cisco Talos released new **Snort Rulesets** to detect exploitation attempts:
* **Snort 2 Rules:** 65498, 65499, 65663-65676.
* **Snort 3 Rules:** 301344, 301368-301374.
* Cisco Security Firewall customers should update to the latest SRU.
## References
* **Vendor Advisories:** Microsoft Security Update Guide (for January 2026 release).
* **Relevant Links:**
* Talos Intelligence Blog: hxxps://blog.talosintelligence.com/
* Snort.org (for rule downloads): hxxps://www.snort.org/