Microsoft Patch Tuesday January 2026: Actively Exploited Zero Day, 8 High-Risk Flaws

Microsoft's Patch Tuesday for January 2026 addresses 112 Microsoft CVEs (and three non-Microsoft CVEs), including an actively exploited zero-day information disclosure in Desktop Window Manager (CVE-2026-20805) that was added to CISA’s KEV catalog, eight additional “exploitation more likely” high-risk flaws (several allowing local privilege escalation or local code execution), and three highest-rated 8.8-severity vulnerabilities in SharePoint and RRAS that Microsoft judged at lower risk of attack.