Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited
Summary: Microsoft released its first security update of 2026 on Tuesday, fixing 114 flaws in Windows, of which eight are rated Critical and 106 Important, with 58 classified as privilege escalation, 22 information disclosure, 21 remote code execution, and five spoofing. One flaw, CVE-2026-20805 (CVSS 5.5), an information disclosure issue in Desktop Window Manager, has been actively exploited in the wild, and CISA has added it to its KEV catalog with a February 3, 2026 deadline for Federal Civilian Executive Branch agencies.
Key Takeaway: The exploited DWM flaw leaks an ALPC port section address from user-mode memory, which researchers say can defeat ASLR and be chained with a separate code execution bug to turn an unreliable exploit into a repeatable attack - and Microsoft has disclosed no details on who is exploiting it or at what scale.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-30051CVE-2025-65046CVE-2026-0628CVE-2026-20805CVE-2026-21265
- Related
- CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability Known Exploited Vulnerabilities · Jan 13, 2026CVE-2024-30051: Microsoft DWM Core Library Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 14, 2024