Alerts

Microsoft January 2026 Patch Tuesday: 114 Vulnerabilities Fixed Including 3 Zero-Days

Zero Day Wire

13 Jan 2026 — 1 min read

Microsoft's first Patch Tuesday of 2026 addresses 114 security vulnerabilities across Windows, Office, and related services. The release includes 12 critical-severity flaws and patches for three zero-day vulnerabilities.

By the Numbers

Zero-Days Patched

Three zero-day vulnerabilities were addressed in this release:

CVE-2026-20805 - Desktop Window Manager information disclosure flaw allowing unauthorized access to sensitive data
CVE-2026-21265 - Windows Digital Media elevation of privilege bug commonly used in attack chains
CVE-2023-31096 - Legacy Agere Soft Modem driver elevation of privilege issue included in cumulative updates

Critical Vulnerabilities

The most severe flaws patched this month include:

CVE-2026-20854 - Use-after-free in Windows LSASS enabling remote code execution over the network
CVE-2026-20944 - Out-of-bounds read in Microsoft Word allowing RCE
CVE-2026-20953 / CVE-2026-20952 - Use-after-free vulnerabilities in Microsoft Office
CVE-2026-20955 / CVE-2026-20957 - Pointer and integer underflow issues in Microsoft Excel
CVE-2026-20822 - Graphics Component elevation of privilege via use-after-free
CVE-2026-20876 - VBS Enclave elevation of privilege

Patch Priority

Administrators should prioritise:

Internet-facing systems including WSUS servers (CVE-2026-20856) and SMB servers
Office endpoints due to multiple critical RCE flaws
Systems running affected kernel drivers

Testing in staging environments is recommended due to potential regressions in drivers like Cloud Files Mini Filter. Monitor CISA KEV for any rapid additions as zero-days may see active exploitation.

Google Attributes Axios npm Supply Chain Attack to North Korean UNC1069, Links Backdoor to WAVESHAPER Evolution

Google has formally attributed the Axios npm supply chain attack to UNC1069, a North Korean threat cluster tracked by Mandiant and Google's Threat Intelligence Group since 2018. The attribution, confirmed by GTIG chief analyst John Hultquist, links the compromise of the JavaScript ecosystem's most popular HTTP

CISA Orders Emergency Patch for Actively Exploited Citrix NetScaler Flaw Resembling CitrixBleed (CVE-2026-3055)

CISA has issued an emergency patching directive for a critical Citrix NetScaler vulnerability that is already being exploited in the wild to hijack administrator sessions on exposed appliances. The agency added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog on Monday and ordered all Federal Civilian Executive Branch agencies to secure

Axios Supply Chain Attack Delivers Cross-Platform RAT to Millions After npm Maintainer Account Hijacked

A coordinated supply chain attack targeting the Axios npm package has delivered a cross-platform remote access trojan to developer workstations and CI/CD environments worldwide, after an attacker hijacked the lead maintainer's npm credentials and published two backdoored releases to the official registry. The attack, executed in the

RedLine Infostealer Administrator Extradited to US, Faces Up to 20 Years for Running MaaS Infrastructure

Armenian national Hambardzum Minasyan has been extradited to the United States for his alleged role in maintaining RedLine's command-and-control infrastructure, managing affiliate payments, and distributing the infostealer — one of the most prolific credential-stealing operations since 2020.

Read more

Google Attributes Axios npm Supply Chain Attack to North Korean UNC1069, Links Backdoor to WAVESHAPER Evolution

CISA Orders Emergency Patch for Actively Exploited Citrix NetScaler Flaw Resembling CitrixBleed (CVE-2026-3055)

Axios Supply Chain Attack Delivers Cross-Platform RAT to Millions After npm Maintainer Account Hijacked

RedLine Infostealer Administrator Extradited to US, Faces Up to 20 Years for Running MaaS Infrastructure