On January 13, 2026, Microsoft rolled out its first significant security update of the year as part of the monthly Patch Tuesday cycle — a scheduled event where the company publishes patches for security flaws across Windows and associated products. This January update was one of the more substantial releases in recent months, tackling a whopping 114 vulnerabilities spanning everything from core Windows components to Office and server products.
A Closer Look at the Numbers
The breadth of this month’s Patch Tuesday reflects the maturity and complexity of modern enterprise software. In total, Microsoft addressed:
- 114 security issues, including both newly discovered flaws and some that had been publicly known prior to the release.
- Of these, eight were rated “Critical”, meaning they are the most severe and could allow attackers to run malicious code with little to no user interaction.
- The majority, however, fell into the “Important” category — still serious, but often requiring specific conditions such as local access or user interaction.
The types of vulnerabilities fixed this month were varied, but the largest group — 57 flaws — were elevation-of-privilege vulnerabilities that could let a malicious actor gain higher access rights than intended. There were also 22 remote code execution (RCE) issues, 22 information disclosure bugs, and a handful of other issues, including denial-of-service and spoofing vulnerabilities.
Zero-Days: What Was Fixed?
Perhaps the most pressing aspect of the January 2026 update was the patching of three zero-day vulnerabilities — flaws that attackers know about and may already be exploiting before a patch is formally released.
- Desktop Window Manager (DWM) Information Disclosure – CVE-2026-20805:
This was the one zero-day actively exploited in the wild before the patch landed, prompting urgency among IT teams to prioritize this fix. The flaw allowed local attackers to extract sensitive memory information from the DWM subsystem — a core part of Windows responsible for graphical display. Even though this isn’t a remote attack, information disclosure can serve as a stepping stone toward more powerful exploits. - Secure Boot Certificate Expiration Bypass – CVE-2026-21265:
This vulnerability affected Windows Secure Boot, a critical firmware-level security feature. The flaw could let attackers bypass protections tied to certificate handling within Secure Boot. While there’s no evidence that this was exploited in the wild, Microsoft and security researchers alike stress that missing this patch could lead to serious trust and update issues if certificates expire. - Windows Agere Soft Modem Driver Elevation – CVE-2023-31096:
A publicly disclosed zero-day affecting legacy hardware drivers, this flaw could allow authenticated local attackers to escalate privileges. Although this driver has become increasingly obsolete, the vulnerability still highlighted the risk of forgotten or unmanaged components in enterprise environments.
Why It Matters
Zero-day vulnerabilities are always a big deal because attackers can exploit them before patches are available. Once a patch is released, adversaries tend to reverse-engineer it to find ways around the fix — meaning unpatched systems become even more vulnerable over time. That’s why Microsoft — and the industry at large — urges administrators to deploy these updates as soon as possible, especially for high-severity and actively exploited issues.
Moreover, the fact that so many vulnerabilities (especially privilege escalations and RCEs) are still being found and patched underscores that cybersecurity remains an ongoing challenge — not a one-time task. Robust update practices, combined with monitoring and defensive measures, are essential to keep systems safe.
Final Thought
This Patch Tuesday serves as a reminder that even well-managed environments can accumulate risk. With 114 flaws fixed — including three zero-days — January’s update is both a testament to Microsoft’s ongoing security efforts and a call to action for sysadmins everywhere: keep your systems patched, prioritize critical updates, and don’t underestimate the importance of routine maintenance in defending against real-world threats.
