Microsoft Fixes 114 Windows Bugs: January 2026 Patch Tuesday

Microsoft has released its first Patch Tuesday update of 2026, fixing a total of 114 security vulnerabilities in Windows. Importantly, the update includes one flaw that is already being actively exploited in real-world attacks, making this month’s patch especially critical for organizations and individual users.

From an SEO and cybersecurity awareness perspective, this update highlights why timely Windows patching remains essential in defending against modern threats such as privilege escalation, information disclosure, and advanced malware campaigns.

Out of the 114 vulnerabilities addressed:

• 8 vulnerabilities are rated Critical

• 106 vulnerabilities are rated Important

According to vulnerability tracking data from Fortra, this is the third-largest January Patch Tuesday Microsoft has ever released, following January 2025 and January 2022. The high volume reflects the growing complexity of the Windows ecosystem and the increasing pressure from attackers exploiting weak points in operating systems.

The flaws patched this month include:

• 58 Privilege Escalation vulnerabilities

• 22 Information Disclosure flaws

• 21 Remote Code Execution vulnerabilities

• 5 Spoofing issues

Privilege escalation vulnerabilities continue to dominate, which is concerning because they often allow attackers to move from a low-privileged account to full system control.

The most urgent issue in this update is CVE-2026-20805, an information disclosure vulnerability affecting the Desktop Window Manager (DWM) component of Windows.

• CVSS score: 5.5

• Status: Actively exploited in the wild

• Discovered by: Microsoft Threat Intelligence Center (MTIC) and Microsoft Security Response Center (MSRC)

Desktop Window Manager is responsible for rendering everything you see on a Windows screen. Because almost every application interacts with it, DWM offers attackers a powerful target.

According to Microsoft, successful exploitation could allow an authenticated attacker to leak sensitive user-mode memory information, specifically an ALPC (Advanced Local Procedure Call) port section address. While this may sound technical, the impact is serious.

Security experts explain that such leaks can help attackers:

• Bypass Address Space Layout Randomization (ASLR)

• Improve the reliability of memory-based exploits

• Chain this flaw with other vulnerabilities to achieve full system compromise

Although Microsoft has not disclosed who is exploiting this vulnerability or how widespread the attacks are, its inclusion in active exploitation confirms a real and present threat.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20805 to its Known Exploited Vulnerabilities (KEV) catalog.

This action requires Federal Civilian Executive Branch (FCEB) agencies to apply the patch by February 3, 2026. Historically, when CISA mandates a fix, it signals that the vulnerability is being leveraged by capable and determined threat actors.

This is not the first time Desktop Window Manager has been abused. In May 2024, Microsoft patched another actively exploited DWM zero-day (CVE-2024-30051), which was used by multiple threat actors alongside malware such as QakBot.

Security researchers note that DWM has had 20 CVEs patched since 2022, making it a frequent target due to its privileged access and central role in Windows operations.

Another important vulnerability fixed in this update is CVE-2026-21265, a Secure Boot security feature bypass.

• CVSS score: 6.4

• Impact: Weakens Windows Secure Boot protections

Secure Boot is designed to ensure that only trusted firmware and bootloaders run during system startup. Exploiting this flaw could allow attackers to undermine boot-time security, potentially enabling stealthy malware that loads before Windows even starts.

Microsoft has also reminded customers that three Secure Boot certificates issued in 2011 will expire starting June 2026. Organizations are strongly advised to migrate to the 2023 certificates to avoid boot failures and security gaps.

Failure to update these certificates could lead to systems that either fail to boot securely or are exposed to boot-level malware attacks.