Microsoft Addresses Critical Vulnerabilities in January 2026 Patch Tuesday

On January 10, 2026, Microsoft released its first Patch Tuesday updates for the year, addressing a total of 113 vulnerabilities across its Windows operating systems and supported software. Among these, eight vulnerabilities received a critical severity rating, with one zero-day flaw, tracked as CVE-2026-20805, already being actively exploited in the wild. This flaw resides in the Desktop Window Manager (DWM), a crucial component responsible for managing user interface windows.

Microsoft Patches Exploited Windows Zero-Day, 111 Other VulnerabilitiesKrebs on Security

CVE-2026-20805 has been described as an information disclosure vulnerability that could allow unauthorized access to sensitive information. According to Microsoft, successful exploitation could lead to the disclosure of user-mode memory addresses. Kev Breen, senior director of cyber threat research at Immersive, emphasized that despite its moderate CVSS score of 5.5, the active exploitation of this flaw signifies a serious threat. He noted that such vulnerabilities can be leveraged to undermine Address Space Layout Randomization (ASLR), a key security measure in operating systems.

Krebs on SecurityMicrosoft Patches Exploited Windows Zero-Day, 111 Other Vulnerabilities

In addition to CVE-2026-20805, Microsoft patched two critical remote code execution vulnerabilities in Microsoft Office (CVE-2026-20952 and CVE-2026-20953), which can be triggered simply by viewing a malicious message in the Preview Pane. Furthermore, the updates included the removal of several legacy modem drivers due to a similar elevation of privilege vulnerability tracked as CVE-2023-31096, which has been known for over two years.

Krebs on SecurityMicrosoft Patches Exploited Windows Zero-Day, 111 Other Vulnerabilities

Another significant vulnerability addressed is CVE-2026-21265, which affects Windows Secure Boot. This feature is designed to protect against rootkits and bootkits, relying on certificates that are set to expire in mid-2026. Adam Barnett from Rapid7 warned that failure to update these certificates could leave systems vulnerable to attacks post-expiration.

Krebs on Security

Microsoft has not disclosed specific details regarding the attacks exploiting CVE-2026-20805, but it has acknowledged the importance of rapid patching as the primary mitigation strategy. Chris Goettl from Ivanti cautioned against underestimating the severity of vulnerabilities based on their ratings, advocating for a risk-based prioritization approach.

Krebs on Security

Experts have raised concerns about the legacy modem drivers still present in Windows systems, questioning how many more vulnerabilities may arise from outdated components. Barnett highlighted the risks associated with these drivers, suggesting that they could continue to be exploited if not addressed.

Krebs on Security

As the cybersecurity landscape evolves, organizations are urged to prioritize the installation of these patches to mitigate the risks associated with these vulnerabilities. Ongoing monitoring and updates from Microsoft and other software vendors, including anticipated updates for Google Chrome and Microsoft Edge, will be crucial in maintaining system security.

Krebs on Security

“By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack,” — Kev Breen, Senior Director of Cyber Threat Research at Immersive

Krebs on Security

“Fifteen years is a very long time indeed in information security, but the clock is running out on the Microsoft root certificates which have been signing essentially everything in the Secure Boot ecosystem since the days of Stuxnet,” — Adam Barnett, Rapid7

Krebs on Security

“Expect Google Chrome and Microsoft Edge updates this week in addition to a high severity vulnerability in Chrome WebView that was resolved in the January 6 Chrome update (CVE-2026-0628),” — Chris Goettl, Vice President of Product Management at Ivanti

Krebs on Security