Microsoft Patches 113 Vulnerabilities Including Critical CVE-2026-20805

On January 10, 2026, Microsoft issued patches for at least 113 security vulnerabilities in its Windows operating systems and supported software. Eight of these vulnerabilities received a critical rating, with CVE-2026-20805 being particularly concerning as it is actively exploited in the wild. This zero-day flaw affects the Desktop Window Manager (DWM), which is essential for managing windows on user screens. Despite its CVSS score of 5.5, experts warn that the flaw can be exploited to undermine key security measures like Address Space Layout Randomization (ASLR).

Chris Goettl from Ivanti highlighted that dismissing the severity of CVE-2026-20805 based on its rating could be a mistake, urging organizations to prioritize patching. In addition to this vulnerability, Microsoft addressed two critical remote code execution vulnerabilities in Microsoft Office, identified as CVE-2026-20952 and CVE-2026-20953, which can be triggered by merely viewing malicious messages.

Microsoft also removed several modem drivers due to vulnerabilities, including CVE-2023-31096, which could allow elevation of privilege attacks. This removal is part of an ongoing effort to mitigate risks associated with legacy drivers that have been part of Windows for decades. Experts are concerned about the potential for more vulnerabilities to emerge from these outdated components.

Another critical vulnerability, CVE-2026-21265, affects Windows Secure Boot, a feature designed to protect against rootkits and bootkits. This vulnerability is tied to certificates that will expire in mid-2026, which could leave devices vulnerable if not updated. The urgency of addressing these vulnerabilities is underscored by the potential for significant security breaches if organizations fail to act.

Implications for Users and Organizations

For everyday users and organizations, the January 2026 Patch Tuesday highlights the critical need for timely software updates to mitigate security risks. The active exploitation of CVE-2026-20805 serves as a reminder that vulnerabilities can be leveraged by threat actors before patches are available. Users should remain vigilant and ensure their systems are updated promptly to protect against these threats.

Organizations should also consider implementing a risk-based prioritization approach to vulnerability management, treating vulnerabilities like CVE-2026-20805 with higher urgency than their ratings might suggest. Regular monitoring for updates and potential exploits is essential to maintain a strong security posture.