Microsoft Patch Tuesday January 2026: 114 Vulnerabilities Fixed

At TecnetOne, we closely monitor every significant security update, and Microsoft’s January 2026 Patch Tuesday is one of those releases that deserves special attention. This time, Microsoft addressed 114 vulnerabilities, including one that was already being actively exploited and two zero-days that had been publicly disclosed, significantly increasing the risk level for systems that are not updated promptly.

This patch bundle also includes fixes for eight critical vulnerabilities—six of which enable remote code execution (one of the most dangerous attack vectors), and two that involve privilege escalation, a scenario that could grant attackers full control of the system if not mitigated swiftly.

These are the vulnerabilities addressed, categorized by type:

1. 57 privilege escalation vulnerabilities

2. 3 security feature bypass vulnerabilities

3. 22 remote code execution vulnerabilities

4. 22 information disclosure vulnerabilities

5. 2 denial of service vulnerabilities

6. 5 spoofing vulnerabilities

It’s important to note that this count only includes vulnerabilities published by Microsoft in this Patch Tuesday release. It does not cover other recent fixes, such as those related to Edge or updates applied to other components earlier in the month.

In summary: a large, critical update, especially relevant for enterprise environments aiming to reduce risks and stay protected against active threats.

Zero-Day Vulnerabilities: One Already Exploited

This month’s Patch Tuesday addresses three zero-day vulnerabilities: one that was already being actively exploited and two that had been publicly disclosed, making them a real risk for unpatched systems. The most critical vulnerability addressed in this update is:

CVE-2026-20805 – Information Disclosure Vulnerability in Desktop Window Manager

This flaw affects the Windows Desktop Window Manager and was already being used by attackers. In simple terms, the vulnerability allows a user with access to the system to obtain sensitive information from the machine, which can facilitate more complex attacks.

According to Microsoft, exploiting this flaw allows an attacker to read memory addresses associated with a remote ALPC port. While it does not involve direct code execution, this type of information leak is often a crucial step in escalating privileges or bypassing other security defenses.

Publicly Disclosed Zero-Days

In addition to the exploited zero-day, Microsoft also addressed two other vulnerabilities that had already been publicly disclosed.

CVE-2026-21265 – Secure Boot Certificate Expiration Bypass

This issue is related to Windows Secure Boot. Microsoft warned that some certificates issued in 2011 are nearing expiration, and systems that are not updated could be exposed to attacks that bypass Secure Boot protections.

In practice, this increases the risk that an attacker could load untrusted software during system startup—something especially concerning in enterprise environments.

CVE-2023-31096 – Privilege Escalation in Agere Soft Modem Driver

This vulnerability affects a third-party modem driver (Agere) included in supported versions of Windows. Microsoft had previously warned about its active exploitation in recent months, where it was used to gain administrative privileges on compromised systems.

With the January 2026 updates, Microsoft took definitive action: it completely removed the vulnerable drivers (agrsm64.sys and agrsm.sys) from the operating system.

According to the company, these drivers were natively removed in the January cumulative update, thereby reducing the risk of them being reused as an attack vector.

Read more: Patch Management: Why is it essential in IT security?

January 2026 Patch Tuesday Security Updates

The January 2026 Patch Tuesday is a powerful reminder of the importance of keeping systems up to date. With 114 vulnerabilities patched and 3 active zero-days, this update should not be delayed.

Timely updates, understanding the risks, and adopting a comprehensive cybersecurity strategy make the difference between a secure environment and a vulnerable one.