Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws

Today is Microsoft’s January 2026 Patch Tuesday with security updates for 114 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday also addresses eight “Critical” vulnerabilities, 6 of which are remote code execution flaws and 2 are elevation-of-privilege flaws.

The number of bugs in each vulnerability category is listed below:

• 57 Elevation of Privilege vulnerabilities
• 3 Security Feature Bypass vulnerabilities
• 22 Remote Code Execution vulnerabilities
• 22 Information Disclosure vulnerabilities
• 2 Denial of Service vulnerabilities
• 5 Spoofing vulnerabilities

When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include Microsoft Edge (1 flaw) and Mariner vulnerabilities fixed earlier this month.

3 zero-days, one exploited

This month’s Patch Tuesday fixes one actively exploited and two publicly disclosed zero-day vulnerabilities.

Microsoft classifies a zero-day flaw as publicly disclosed or actively exploited while no official fix is available.

The actively exploited zero-day is:

CVE-2026-20805 – Desktop Window Manager Information Disclosure Vulnerability

Microsoft has patched an actively exploited information disclosure flaw in the Desktop Window Manager.

“Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally,” explains Microsoft.

Microsoft says that successfully exploiting the flaw allows attackers to read memory addresses associated with the remote ALPC port.

“The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a section address from a remote ALPC port which is user-mode memory,” continued Microsoft.

Microsoft has attributed the flaw to Microsoft Threat Intelligence Center (MSTIC) & Microsoft Security Response Center (MSRC) but has not shared how the flaw was exploited.

The publicly disclosed zero-day flaws are:

CVE-2026-21265 – Secure Boot Certificate Expiration Security Feature Bypass Vulnerability

Microsoft is warning that Windows Secure Boot certificates issued in 2011 are nearing expiration, and systems that are not updated have increased risk of threat actors bypassing Secure Boot.

The following certificates are nearing expiration

The security updates renew the affected certificates to preserve the Secure Boot trust chain and allow continued verification of boot components.

Microsoft has previously disclosed this vulnerability in a June advisory titled “Windows Secure Boot certificate expiration and CA updates“.

CVE-2023-31096 – MITRE: CVE-2023-31096 Windows Agere Soft Modem Driver Elevation of Privilege Vulnerability

As part of the October Patch Tuesday, Microsoft previously warned of actively exploited vulnerabilities in a third-party Agere Modem driver that ships with supported Windows versions and said they would be removed in a future update.

These vulnerabilities were exploited to gain administrative privileges on compromised systems.

As part of today’s Patch Tuesday updates, Microsoft has now removed these vulnerable drivers from Windows.

“Microsoft is aware of vulnerabilities in the third party Agere Soft Modem drivers that ship natively with supported Windows operating systems,” explains Microsoft.

“This is an announcement of the removal of agrsm64.sys and agrsm.sys drivers. The drivers have been removed in the January 2026 cumulative update.”

Microsoft attributes this to Zeze with TeamT5.

Recent updates from other companies

Other vendors who released updates or advisories in January 2026 include:

• Adobe released security updates for InDesign, Illustrator, InCopy, Bridge, Substance 3D Modeler, Substance 3D Stager, Substance 3D Painter, Substance 3D Sampler, Coldfusion, and Substance 3D Designer.
• Cisco released security updates for an Identity Services Engine (ISE) vulnerability with a public proof-of-concept exploit code
• Fortinet released security updates for multiple products, including fixes for two RCEs.
• D-Link confirmed that a new actively exploited vulnerability impacts end-of-life routers.
• Google has released Android’s January security bulletin, which includes a fix for one critical “DD+ Codec” flaw that impacts Dolby components.
• jsPDF fixed a critical vulnerability that could be used to smuggle arbitrary files from a server while generating PDFs.
• n8n fixed a maximum-severity vulnerability dubbed “Ni8mare” that can be used to hijack servers.
• SAP released the January security updates for multiple products, including a fix for a 9.9/10 code injection flaw in SAP Solution Manager.
• ServiceNow disclosed a critical privilege escalation vulnerability in the ServiceNow AI Platform.
• Trend Micro patched a critical security flaw in Apex Central (on-premise) that could allow attackers to execute arbitrary code with SYSTEM privileges.
• Veeam released security updates to patch multiple security flaws in its Backup & Replication software, including a critical RCE vulnerability.

The January 2026 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the January 2026 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Update 12/10/25: Our subsection title about the zero-days incorrectly said two were exploited, instead of one.

7 Security Best Practices for MCP

As MCP (Model Context Protocol) becomes the standard for connecting LLMs to tools and data, security teams are moving fast to keep these new services safe.

This free cheat sheet outlines 7 best practices you can start using today.

Download Now