Alerts

Microsoft January 2026 Patch Tuesday: 114 Vulnerabilities Fixed Including 3 Zero-Days

Zero Day Wire

— 1 min read
Microsoft January 2026 Patch Tuesday: 114 Vulnerabilities Fixed Including 3 Zero-Days

Microsoft's first Patch Tuesday of 2026 addresses 114 security vulnerabilities across Windows, Office, and related services. The release includes 12 critical-severity flaws and patches for three zero-day vulnerabilities.

By the Numbers

Zero-Days Patched

Three zero-day vulnerabilities were addressed in this release:

  • CVE-2026-20805 - Desktop Window Manager information disclosure flaw allowing unauthorized access to sensitive data
  • CVE-2026-21265 - Windows Digital Media elevation of privilege bug commonly used in attack chains
  • CVE-2023-31096 - Legacy Agere Soft Modem driver elevation of privilege issue included in cumulative updates

Critical Vulnerabilities

The most severe flaws patched this month include:

Patch Priority

Administrators should prioritise:

  1. Internet-facing systems including WSUS servers (CVE-2026-20856) and SMB servers
  2. Office endpoints due to multiple critical RCE flaws
  3. Systems running affected kernel drivers

Testing in staging environments is recommended due to potential regressions in drivers like Cloud Files Mini Filter. Monitor CISA KEV for any rapid additions as zero-days may see active exploitation.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire