Microsoft Fixes 114 Windows Flaws in January 2026 Patch, One Actively Exploited

Microsoft's January 2026 Patch Tuesday update delivers critical security fixes for Windows environments, addressing 114 vulnerabilities across the ecosystem. Among these, security teams should prioritize an actively exploited information disclosure flaw (CVE-2026-20805) affecting Desktop Window Manager (DWM), which threat actors are currently leveraging to bypass core memory protections. This marks Microsoft's third-largest January update since 2022 according to Fortra data.

The exploited DWM vulnerability (CVSS 5.5) allows local attackers to disclose sensitive memory addresses used by Windows components through the Advanced Local Procedure Call (ALPC) system. Adam Barnett, Lead Software Engineer at Rapid7, explains: "DWM handles everything displayed on Windows systems, giving attackers privileged access to universal processes. Here, exploitation reveals ALPC port section addresses—memory regions coordinating actions between system components."

Security researchers emphasize the severity despite its moderate CVSS score. "This vulnerability undermines Address Space Layout Randomization (ASLR), a fundamental security control against memory exploits," notes Kev Breen, Senior Director of Cyber Threat Research at Immersive Labs. "By exposing memory locations, attackers can chain it with execution flaws to create reliable attack sequences." Microsoft Threat Intelligence Center confirmed active exploitation, prompting CISA to add it to their Known Exploited Vulnerabilities catalog with a February 3, 2026 remediation deadline for federal agencies.

Satnam Narang, Senior Staff Research Engineer at Tenable, observes that DWM has become a "frequent flyer" in Patch Tuesdays, with 20 CVEs patched since 2022. The component previously suffered exploitation in May 2024 (CVE-2024-30051) during QakBot malware campaigns.

Critical Supplementary Fixes

Three additional high-impact patches warrant immediate attention:

1. Secure Boot Certificate Expiration Bypass (CVE-2026-21265)
   • CVSS 6.4 security feature bypass
   • Compromises verification of trusted firmware during boot
   • Coincides with Microsoft's warning about expiring Secure Boot certificates in June 2026. Organizations must migrate to 2023 certificates (Microsoft guidance) to maintain boot security.

1. Virtualization-Based Security Escape (CVE-2026-20876)

   • CVSS 6.7 critical privilege escalation
   • Compromises Virtual Trust Level 2 (VTL2) enclaves
   • "Breaks the security boundary protecting Windows itself," warns Action1's Mike Walters. "Attackers with initial access could defeat advanced virtualization defenses for deep persistence."

2. Legacy Driver Removal

   • Agere Soft Modem drivers (agrsm64.sys/agrsm.sys) removed
   • Prevents exploitation of CVE-2023-31096 privilege escalation
   • Follows October 2025 removal of ltmdm64.sys driver due to similar risks

Actionable Recommendations

1. Prioritize CVE-2026-20805: Patch immediately given active exploitation and ASLR bypass implications
2. Audit Secure Boot certificates: Validate systems use 2023 certificates before June 2026 expiration
3. Update virtualization hosts: Isolate and patch systems using Virtualization-Based Security first
4. Verify driver cleanup: Use PowerShell (Get-WindowsDriver -Online -All) to confirm removal of vulnerable Agere drivers

For complete technical details, reference Microsoft's January 2026 Security Update Guide.