Patch Tuesday: January 2026 (Expel’s version)

January 13, 2026 Patch Tuesday covers 112 CVEs and highlights one actively exploited zero-day (CVE-2026-20805) added to CISA's KEV; the bulletin reviews notable Microsoft vulnerabilities (RCEs, privilege escalations, information disclosure) and summarizes 2025 exploit prediction performance—noting 63% of their 46 prioritized CVEs showed exploitation evidence and several were weaponized by malware—concluding with a recommendation to prioritize patching.