Ethical Hacking News
Microsoft Patch Tuesday January 2026 addressed a total of 112 CVEs across various products, including Windows and Office. The update includes eight critical vulnerabilities, which can help attackers bypass security protections and make more serious exploits work. This release highlights the need for companies to prioritize cybersecurity and maintain their software on a regular basis to minimize potential risks.
112 CVEs (Common Vulnerability Exchange) addressed in Microsoft's Patch Tuesday for January 2026. Eight critical vulnerabilities, a notable increase from previous months. CVE-2023-31096 and CVE-2024-55414 were publicly known at the time of release. A large number of patches in one release is not uncommon during Patch Tuesday updates. Microsof has made significant efforts to address security vulnerabilities, including zero-day weaknesses.
Microsoft's Patch Tuesday for January 2026 has addressed a total of 112 CVEs (Common Vulnerability Exchange) across various products, including Windows, Office, Azure, Edge, SharePoint, SQL Server, SMB, and Windows management services. This update includes eight critical vulnerabilities, which is a notable increase from previous months. The release of these patches coincides with the start of a new year, where vendors often delay their updates during the holiday season to avoid disruptions.
The actively exploited zero-day vulnerability, CVE-2026-20805, affects Windows Desktop Window Manager and allows attackers to leak small pieces of memory information. Although this weakness does not directly run malicious code, it can help attackers bypass security protections and make more serious exploits work. Microsoft has not disclosed any details about the attacks exploiting this vulnerability.
The updated patch addresses two publicly known vulnerabilities at the time of its release: CVE-2023-31096 and CVE-2024-55414. CVE-2023-31096 affects outdated Agere Soft Modem drivers included with Windows, which allows attackers to gain higher system privileges by exploiting these drivers. If abused, it could let a local attacker take deeper control of a device.
CVE-2024-55414 affects Motorola Soft Modem drivers included with Windows and also grants elevated system privileges. The flaw exists in the smserl64.sys and smserial.sys drivers, which Microsoft removed in the January cumulative update. Systems that still rely on this legacy hardware may face compatibility issues and security risks.
The use of a large number of patches in a single release is not uncommon during Patch Tuesday updates. This trend can be attributed to vendors often delaying their releases during the holidays to minimize disruptions to users and businesses.
Microsoft has made significant efforts to address security vulnerabilities, including fixing actively exploited zero-day weaknesses and publishing critical patch updates on a timely basis. These updates demonstrate the importance of ongoing software maintenance and the need for companies to prioritize cybersecurity to mitigate potential risks.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Patch-Tuesday-January-2026-A-Critical-Update-to-Mitigate-Exploited-Zero-Day-Vulnerabilities-ehn.shtml
https://securityaffairs.com/186888/hacking/microsoft-patch-tuesday-security-updates-for-january-2026-fixed-actively-exploited-zero-day.html
Published: Wed Jan 14 03:12:42 2026 by llama3.2 3B Q4_K_M
