Three Zero-Days, 114 Flaws Fixed: Microsoft Kicks Off 2026 with a Major Patch Tuesday

This month’s Patch Tuesday marks a significant start to the year, with Microsoft delivering a heavy volume of updates to address 114 vulnerabilities. This includes 3 zero-day flaws, one of which is actively exploited.

The sheer volume, doubling the count from last month, highlights the importance of a rapid deployment cycle for IT teams this January.

Here is a breakdown of the 114 vulnerabilities addressed in the January 2026 update:

This month is particularly high-risk due to three zero-day vulnerabilities, meaning they were either publicly disclosed or actively exploited before a patch was available.

• Overview: A vulnerability in the Windows DWM component that organizes how application windows appear on screen.
• Risk:Although rated as Info Disclosure, it is actively exploited to leak memory addresses, which enables attackers to bypass security protections such as ASLR for multi-stage attacks.

• Overview: A vulnerability related to expiring Secure Boot certificates from 2011.
• Risk: This flaw could allow an attacker to bypass Secure Boot integrity checks. This patch rotates the expiring certificates to ensure boot security is maintained.

• Overview: A legacy driver vulnerability that was publicly disclosed.
• Risk: To mitigate risk, Microsoft has officially removed these legacy drivers (agrsm64.sys) from the Windows operating system in this update.

The January 2026 update is comprehensive, impacting a wide array of Microsoft’s ecosystem:

• Core Operating System: Windows 10, Windows 11, and Windows Server (2019, 2022, 2025).
• Development Tools: .NET, Visual Studio, and Azure DevOps Server.
• Database & Productivity: Microsoft SQL Server and Microsoft Office.
• System Components: Windows Kernel, Windows Installer, and the Cloud Files Mini Filter Driver.
• Browsers: Microsoft Edge (Chromium-based).

The diversity of these fixes, ranging from kernel-level drivers to user-facing applications like Office, means that almost every Windows-based environment (on-premise or cloud) is affected.

1. Prioritize the Active Zero-Day: Immediately deploy patches for CVE-2026-20805. Because it is already being used in attacks, this should be the top priority for all systems.
2. Apply OS-Level Patches First: Given the two publicly disclosed elevation of privilege flaws in the Kernel and Installer, focus on updating Windows client and server operating systems.
3. Validate Critical RCE Fixes: With 31 RCE vulnerabilities addressed, ensure that systems exposed to the internet or untrusted networks are updated to prevent remote code execution attacks.
4. Audit Server Environments: Don’t forget infrastructure-specific updates, particularly for SQL Server and Azure DevOps Server, which often require specialized maintenance windows.
5. Review Defense-in-Depth: Beyond patching, monitor for unusual local privilege escalation attempts and ensure that the Principle of Least Privilege (PoLP) is strictly enforced to mitigate the impact of any potential breach.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.