Microsoft’s January 2026 Patch Tuesday Addresses 113 CVEs (CVE-2026-20805)

8Critical105Important0Moderate0LowMicrosoft addresses 113 CVEs in the first Patch Tuesday of 2026, with two zero-days, including one that was exploited in the wild.Microsoft patched 113 CVEs in its January 2026 Patch Tuesday release, with eight rated critical and 105 rated as important. Our counts omitted one CVE that was assigned by MITRE, CVE-2023-31096.This month’s update includes patches for:Azure Connected Machine AgentAzure Core shared client library for PythonCapability Access Management Service (camsvc)Connected Devices Platform Service (Cdpsvc)Desktop Window ManagerDynamic Root of Trust for Measurement (DRTM)Graphics KernelHost Process for Windows TasksInbox COM ObjectsMicrosoft Graphics ComponentMicrosoft OfficeMicrosoft Office ExcelMicrosoft Office SharePointMicrosoft Office WordPrinter Association ObjectSQL ServerTablet Windows User Interface (TWINUI) SubsystemWindows Admin CenterWindows Ancillary Function Driver for WinSockWindows Client-Side Caching (CSC) ServiceWindows Clipboard ServerWindows Cloud Files Mini Filter DriverWindows Common Log File System DriverWindows DWMWindows Deployment ServicesWindows Error ReportingWindows File ExplorerWindows HTTP.sysWindows HelloWindows Hyper-VWindows InstallerWindows Internet Connection Sharing (ICS)Windows KerberosWindows KernelWindows Kernel MemoryWindows Kernel-Mode DriversWindows LDAP - Lightweight Directory Access ProtocolWindows Local Security Authority Subsystem Service (LSASS)Windows Local Session Manager (LSM)Windows Management ServicesWindows MediaWindows NDISWindows NTFSWindows NTLMWindows Remote AssistanceWindows Remote Procedure CallWindows Remote Procedure Call Interface Definition Language (IDL)Windows Routing and Remote Access Service (RRAS)Windows SMB ServerWindows Secure BootWindows Server Update ServiceWindows ShellWindows TPMWindows Telephony ServiceWindows Virtualization-Based Security (VBS) EnclaveWindows WalletServiceWindows Win32K - ICOMPElevation of privilege (EoP) vulnerabilities accounted for 49.6% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 19.5%.ImportantCVE-2026-20805 | Desktop Window Manager Information Disclosure VulnerabilityCVE-2026-20805 is an information disclosure vulnerability affecting Desktop Window Manager. It was assigned a CVSSv3 score of 5.5 and was rated as important. Successful exploitation allows an authenticated attacker to access sensitive data. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.Additionally, Microsoft patched another Desktop Window Manager vulnerability this month. CVE-2026-20871 is an EoP vulnerability that was assigned a CVSSv3 score of 7.8 and was rated as important. Contrary to CVE-2026-20805, CVE-2026-20871 was not exploited in the wild, although it was assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index.ImportantCVE-2026-21265 | Secure Boot Certificate Expiration Security Feature Bypass VulnerabilityCVE-2026-21265 is a security feature bypass in the Windows Secure Boot. It was assigned a CVSSv3 score of 6.4 and is rated important. It was assessed as “Exploitation Less Likely.”Microsoft certificates are stored in the Unified Extensible Firmware Interface (UEFI) Key Enrollment Key (also known as Key Exchange or KEK) and DB. These certificates are reaching their expiration date, so these certificates need to be updated to ensure Secure Boot functionality remains and to prevent future issues from arising. The following are the certificates set to expire in 2026:Certificate Authority (CA)Expiration DatePurposeLocationMicrosoft Corporation KEK CA 2011June 24, 2026Signs updates to the DB and DBXKEKMicrosoft Corporation UEFI CA 2011June 27, 2026Signs third party boot loaders, Option ROMs and moreDBMicrosoft Windows Production PCA 2011October 19, 2026Signs the Windows Boot ManagerDBThis vulnerability is considered “Publicly Disclosed” because the information about the expiration and the location of these certificates are public.CriticalCVE-2026-20952 and CVE-2026-20953 | Microsoft Office Remote Code Execution VulnerabilityCVE-2026-20952 and CVE-2026-20953 are RCE vulnerabilities affecting Microsoft Office. Each of these vulnerabilities were assigned a CVSSv3 score of 8.4, rated as critical and assessed as "Exploitation Less Likely.” An attacker could exploit these flaws through social engineering by sending the malicious Microsoft Office document file to an intended target. Successful exploitation would grant code execution privileges to the attacker.Despite being flagged as “Exploitation Less Likely,” Microsoft notes that the Preview Pane is an attack vector for both vulnerabilities, which means exploitation does not require the target to open the file.ImportantCVE-2026-20840 and CVE-2026-20922 | Windows NTFS Remote Code Execution VulnerabilityCVE-2026-20840 and CVE-2026-20922 are RCE vulnerabilities affecting Windows New Technology File System (NTFS). Both were assigned CVSSv3 scores of 7.8 and are rated as important. Microsoft assessed both of these flaws as “Exploitation More Likely.” According to Microsoft, both these flaws stem from heap-based buffer overflows which can be exploited to execute arbitrary code on an affected system. Both advisories also note that any authenticated attacker can exploit these flaws, regardless of privilege level.Tenable SolutionsA list of all the plugins released for Microsoft’s January 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.Get more informationMicrosoft's January 2026 Security UpdatesTenable plugins for Microsoft January 2026 Patch Tuesday Security UpdatesJoin Tenable's Research Special Operations (RSO) Team on Tenable Connect and engage with us in the Threat Roundtable group for further discussions on the latest cyber threats.Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.