Microsoft January 2026 Patch Tuesday: Critical Fixes & Updates

January 2026 Patch Tuesday: Act Fast: Hackers are targeting Office files you only preview, plus Windows flaws that let them take over systems. One bug is already being exploited. Update Office and Windows now to stay safe.

January 2026 Patch Tuesday: Preview, Privilege, and Proven Exploitation!

Microsoft’s January 2026 Patch Tuesday is less volume and more attack chain enablement. Several vulnerabilities this month materially increase enterprise risk by reducing user interaction requirements, enabling privilege escalation, and in one case, confirmed as exploited.

This release stands out for three recurring patterns:

· Office documents can be exploited via Preview Pane

· Multiple Windows vulnerabilities change security scope, enabling privilege escalation and lateral movement

· Confirmed active exploitation, increasing urgency regardless of CVSS

The Three Vulnerability Patterns CISOs Should Care

1. Office Remote Code Execution via Preview Pane CVE-2026-20944 (Word), CVE-2026-20946 (Excel), CVE-2026-20952 (Office)

Several Microsoft Office vulnerabilities this month allow code execution when a document is previewed, not fully opened.

· Outlook Preview Pane is sufficient

· No macro enablement required

· Highly effective phishing vector

· Impacts desktops, shared inboxes, and VDI environments

These vulnerabilities represent low-effort, high-success initial access vectors that bypass traditional “don’t click” user training.

2. Windows Elevation of Privilege with Scope Change CVE-2026-20965, CVE-2026-20923

January includes 13 vulnerabilities with Scope = Changed, meaning exploitation crosses a security boundary.

· Converts user-level access into SYSTEM control

· Enables lateral movement

· Commonly chained with document-based attacks to full system compromise

These vulnerabilities act as attack accelerators, allowing threat actors to move from initial access to full control rapidly.

3. Desktop Window Manager Information Disclosure Vulnerability CVE-2026-20805 (Exploitation Detected)

The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a section address from a remote ALPC port (Advanced Local Procedure Call) which is user-mode memory. This leak weakens exploit mitigations by revealing internal Windows memory layout, think of it as a high-performance, structured message pipe between processes on the same system.

· Confirms real attacker interest

· This class of flaw is commonly leveraged as part of multi-stage attack chains, particularly alongside elevation of privilege vulnerabilities

· Delayed patching increases blast radius rapidly

Practical Recommendations

1. Prioritize Office patching across all endpoints, shared mailboxes, and VDI environments

2. Fast-track scope-changing Windows fixes, even when rated “Important”

3. Leverage Endpoint Resilience: Absolute Secure Endpoint enables rapid rehydration to a golden image, restoring thousands of devices in hours rather than days, through firmware-embedded persistence.

When attack chains succeed, the organizations that recover fastest are the ones that limit business impact.

Patch smart. Build resilience. Happy patching.

See the Jan 2026 Patch Tuesday Chart (PDF) .

Rob Brown Senior Director of Technical Services Absolute Security

Secure remote access with resilient ZTNA technology is critical for hybrid workforces—ensuring productivity without compromising security.

Absolute can help make your school district’s device collection season as painless and hassle-free as possible.

There are always going to be pros and cons when employees work from versus working from an office. From an IT and security perspective, the distributed nature of today’s workforce has opened up a pandora’s box of potential issues.