Patch Tuesday, January 2026 Edition
Summary: Microsoft issued patches for at least 113 security holes in Windows and supported software, eight rated critical, and confirmed active exploitation of one zero-day, CVE-2026-20805, a Desktop Window Manager flaw with a CVSS score of 5.5. The release also includes two critical Microsoft Office remote code execution bugs (CVE-2026-20952 and CVE-2026-20953) triggered by viewing a booby-trapped message in the Preview Pane, removal of the modem drivers agrsm64.sys and agrsm.sys tied to CVE-2023-31096, and a critical Secure Boot security feature bypass, CVE-2026-21265.
Bottom line: CVE-2026-20805 is already being exploited in the wild, and because Microsoft has not disclosed which other components may be involved in an exploit chain, rapid patching is currently the only effective mitigation. The Secure Boot certificates that have signed the ecosystem since the Stuxnet era expire in June and October 2026, and devices without the 2023 replacements can no longer receive Secure Boot security fixes.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-31096CVE-2026-20805CVE-2026-20952CVE-2026-20953
- Related
- CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability Known Exploited Vulnerabilities · Jan 13, 2026