Microsoft Patch Tuesday January 2026: Vulnerabilities Fixed

Microsoft’s January 2026 Patch Tuesday addresses 114 vulnerabilities, including several critical remote code execution (RCE) flaws. These high-severity bugs impact key targets such as Office applications and core Windows services, notably LSASS. For a comprehensive overview of these fixes, administrators should consult the official <a href="https://msrc.microsoft

This Patch Tuesday addresses critical remote code execution flaws and numerous elevation of privilege issues that could enable attackers to compromise systems.

The release includes 12 critical CVEs and over 90 important CVEs, primarily elevation-of-privilege flaws in kernel drivers and management services.

Zero-Day Vulnerabilities

CVE-2026-20805 involves Desktop Windows Manager flaws exposing information, rated high by researchers. CVE-2026-21265 targets digital media handling for privilege gains, common in chained attacks. CVE-2023-31096 appears as a backported or related fix in the cumulative updates.

Critical Vulnerabilities

Several critical remote code execution vulnerabilities stand out, including CVE-2026-20854 in Windows LSASS, stemming from a use-after-free error exploitable over networks.

The Office suite faces multiple threats: CVE-2026-20944 (Word out-of-bounds read), CVE-2026-20953 and CVE-2026-20952 (use-after-free), and CVE-2026-20955 and CVE-2026-20957 (Excel pointer issues and integer underflow).

Additional critical elevation-of-privilege bugs affect the Graphics Component (CVE-2026-20822) and the VBS Enclave (CVE-2026-20876), both of which exhibit use-after-free vulnerabilities locally.​

Windows components dominate the most critical-rated issues, with over 30 elevation-of-privilege flaws in services such as Management Services, SMB Server, and Win32k, often via race conditions or use-after-free. Information disclosure bugs in File Explorer and VBS round out notable risks.​

Deploy updates starting with internet-facing systems like WSUS (CVE-2026-20856) and SMB servers, then Office endpoints. Test in staging environments due to potential regressions in drivers like Cloud Files Mini Filter. Enable automatic updates for consumer devices and monitor CISA KEV for any rapid additions, as zero-days heighten urgency.

Microsoft Patch Tuesday Vulnerabilities Table

Other Patch Tuesday Updates

• Node.js Security Release Patches 7 Vulnerabilities Across All Release Lines
• FortiSandbox SSRF Vulnerability Allows Attacker to proxy Internal Traffic via Crafted HTTP Requests
• SAP Security Patch Day January 2026 – Patch for Critical Injection and RCE Vulnerabilities
• FortiOS and FortiSwitchManager Vulnerability Let Remote Attackers Execute Arbitrary Code
• Cisco ISE Vulnerability Let Remote attacker Access Sensitive Data – Public PoC Available
• Cisco Snort 3 Detection Engine Vulnerability Leaks Sensitive Data

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.