Microsoft Patch Tuesday addresses 112 defects, including one actively exploited zero-day

Microsoft’s January 2026 Patch Tuesday fixed 112 vulnerabilities, including an actively exploited information-disclosure zero-day (CVE-2026-20805) in Desktop Window Manager that requires local access; the flaw (CVSS 5.5) is listed in CISA’s known exploited vulnerabilities catalog and experts warn leaked memory can enable privilege escalation and multi-stage attacks. Several other high-severity flaws across Office, SharePoint, and Windows components were also fixed, and Microsoft flagged multiple vulnerabilities more likely to be exploited this month.