Security News Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2026-patch-tuesday-fixes-3-zero-days-114-flaws/

Today is Microsoft's January 2026 Patch Tuesday with security updates for 114 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

This Patch Tuesday also addresses eight "Critical" vulnerabilities, 6 of which are remote code execution flaws and 2 are elevation-of-privilege flaws.

The number of bugs in each vulnerability category is listed below:

• 57 Elevation of Privilege vulnerabilities
• 3 Security Feature Bypass vulnerabilities
• 22 Remote Code Execution vulnerabilities
• 22 Information Disclosure vulnerabilities
• 2 Denial of Service vulnerabilities
• 5 Spoofing vulnerabilities

When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include Microsoft Edge (1 flaw) and Mariner vulnerabilities fixed earlier this month.

Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws

Today is Microsoft's January 2026 Patch Tuesday with security updates for 114 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

ZDI: The January 2026 Security Update Review

I may be in Tokyo preparing for Pwn2Own Automotive, but that doesn’t stop patch Tuesday from coming. Put aside you broken New Year’s resolutions for just a moment as we review the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for January 2026

For January, Adobe released 11 bulletins addressing 25 unique CVEs in Adobe Dreamweaver, InDesign, Illustrator, InCopy, Bridge, Substance 3D Modeler, Substance 3D Stager, Substance 3D Painter, Substance 3D Sampler, Substance 3D Designer, and ColdFusion. The patch for ColdFusion fixes a single code execution bug, but the update is listed as Priority 1. It isn’t publicly known or under active attack, though. The fix for Dreamweaver corrects five Critical-rated code execution bugs. The update for InDesign also has five CVEs, but only four are rated Critical. The Substance 3D Modeler patch contains six fixes total, but only two are for arbitrary code execution.

The patch for Substance 3D Stager fixes a single, Critical-rated code execution bug. That’s the same story for Substance 3D Painter, Adobe Bridge, and InCopy. The patch for Substance 3D Sampler is a bit odd. It states that it was released in August but updated today. The CVE is from 2026, so this may just be a clerical error. The patch for Substance 3D Designer fixes a single Important-severity memory leak. Finally, the fix for Illustrator includes one Critical-rated and one Important-severity bug.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Besides the fix for ColdFusion, all of the updates released by Adobe this month are listed as deployment priority 3.

Microsoft Patches for January 2026

Microsoft kicks off the new year with a bang, dropping 112 new CVEs in Windows and Windows components, Office and Office Components, Azure, Microsoft Edge (Chromium-based), SharePoint Server, SQL Server, SMB Server, and Windows Management Services.

One of these bugs came through the ZDI program. Of the patches released today, eight are rated Critical while the rest are rated Important in severity. Counting the third-party Chromium updates listed in the release, it brings to total number of CVEs to 114.

It’s not uncommon to see a large release in January. I suspect vendors hold off on certain updates through the holiday season to prevent disruptions should patches fail or cause application compatibility issues. This results in a large January release. Last year was Microsoft’s second busiest in terms of CVEs released. We’ll see if they top that in 2026.

Microsoft lists one bug under active attack, but two others as publicly known at the time of the release (although I think that number should be three).

Looking Ahead

Assuming I survive Pwn2Own automotive and haven’t transformed into a giant piece of sushi, I’ll be back for the February release on the 10th. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Zero Day Initiative — The January 2026 Security Update Review

I may be in Tokyo preparing for Pwn2Own Automotive, but that doesn’t stop patch Tuesday from coming. Put aside you broken New Year’s resolutions for just a moment as we review the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release

www.zerodayinitiative.com

 

[SeriousHoax]

The update installed fine. No issues so far. But I haven't received the Windows 11 25H2 update yet. I'm not getting it even after enabling, "Get the latest update as soon as they're available" I know it's just one small enablement package away, but I expected to auto receive it by now.

 

[Parkinsond]

The update installed fine. No issues so far. But I haven't received the Windows 11 25H2 update yet. I'm not getting it even after enabling, "Get the latest update as soon as they're available" I know it's just one small enablement package away, but I expected to auto receive it by now.

May be released on stages; I have applied the enablement package successfully few months ago for W 11 IoT Ent LTSC.

 

[SeriousHoax]

May be released on stages; I have applied the enablement package successfully few months ago for W 11 IoT Ent LTSC.

Yeah, I think so too. But it's been almost 4 months now. So, it's been a while. I usually manually take the route of applying enablement package when available but I don't know why I decided to wait this time. Now I feel committed so I'm still waiting

 

[Parkinsond]

Yeah, I think so too. But it's been almost 4 months now. So, it's been a while. I usually manually take the route of applying enablement package when available but I don't know why I decided to wait this time. Now I feel committed so I'm still waiting

I prefer to get updates automatically through W settings, but as my version of W is not officially eligible for 25H2 update, I had to apply it manually.
I reinstalled W later after reading that updating to 25H2 make my version lose its extended security updates until 2034.

 

[lokamoka820]

The update installed fine. No issues so far. But I haven't received the Windows 11 25H2 update yet. I'm not getting it even after enabling, "Get the latest update as soon as they're available" I know it's just one small enablement package away, but I expected to auto receive it by now.

I advise you to wait until it is fully fixed. It may be working well for other members for some time now, but for me, it was automatically installed in October, and it had some errors. Then I received an update to fix it in January, and I am still having some problems. For example, the settings app would crash when I tried to open some sections to edit. I received an update this week and so far there are no problems.

 

[Parkinsond]

I advise you to wait until it is fully fixed. It may be working well for other members for some time now, but for me, it was automatically installed in October, and it had some errors. Then I received an update to fix it in January, and I am still having some problems. For example, the settings app would crash when I tried to open some sections to edit. I received an update this week and so far there are no problems.

View attachment 294664

Good advice; I have read MS blocks releasing certain updates for specific PCs for known compatibility issues; they wait until they get fixed.

 

[Jonny Quest]

Good advice; I have read MS blocks releasing certain updates for specific PCs for known compatibility issues; they wait until they get fixed.

And the funny thing on my end, the one laptop that didn't get the new start menu layout, is a Microsoft Surface 5, and the one that the change did take effect, is a HP laptop (both on 25H2)

 

[Parkinsond]

And the funny thing on my end, the one laptop that didn't get the new start menu layout, is a Microsoft Surface 5, and the one that the change did take effect, is a HP laptop (both on 25H2)

One more reason to love MS.

 

[Divine_Barakah]

One more reason to love MS.

Selfless MS

 

[stonjean633]

One more reason to love MS.

MS protecting their hardware and making other manufacturer's the guinea pig.

 

[Parkinsond]

MS protecting their hardware and making other manufacturer's the guinea pig.

It's logic they get inclined for their hardware; they do not create OS for their exclusive hardware such as Apple.

 

[Miravi]

Good advice; I have read MS blocks releasing certain updates for specific PCs for known compatibility issues; they wait until they get fixed.

I experienced a good length delay before I received 25H2 myself. Thankfully, it seemed their judgement worked in my favor. No incompatibilities or other issues.

 

[Parkinsond]

I experienced a good length delay before I received 25H2 myself. Thankfully, it seemed their judgement worked in my favor. No incompatibilities or other issues.

Enjoy your new version.
I get tempted occasionally to move to 25H2, but I find the extended security updates with 24h2 is a good deal.

 

[Divine_Barakah]

Enjoy your new version.
I get tempted occasionally to move to 25H2, but I find the extended security updates with 24h2 is a good deal.

It is not worth it. I find 24H2 more stable.

 

[Parkinsond]

It is not worth it. I find 24H2 more stable.

May be during the early phase; later bugs get fixed and will be as stable as 24H2.

 

[Miravi]

May be during the early phase; later bugs get fixed and will be as stable as 24H2.

25H2 doesn't even constitute a major upgrade from 24H2. The changes were overall minor and tested for some time. Especially after months of patches, it's thought of as pretty stable, save occasional quirks and some leftover bugs from 24H2. Some of the refinements, like smoother animations and faster search, were more than welcome.

 

[Parkinsond]

25H2 doesn't even constitute a major upgrade from 24H2. The changes were overall minor and tested for some time. Especially after months of patches, it's thought of as pretty stable, save occasional quirks and some leftover bugs from 24H2. Some of the refinements, like smoother animations and faster search, were more than welcome.

I care more for security rather than feature updates; one of the reasons to choose IoT LTSC.

 

[Parkinsond]

Waiting for Feb patch to break things Jan patch missed.