Microsoft has released its January 2026 security updates, addressing a total of 112 separate vulnerabilities across various parts of the Windows operating system and server software. The updates aim to resolve these issues in relevant components, including critical vulnerabilities in the Windows Server Update Service component with a CVSS score of 8.1.
Microsoft January 2026 Security Updates
Microsoft has released its January 2026 security updates. These roll out across Windows Deployment Services, SQL Server, and various other parts of the operating system and server software.
The updates tackle a total of 112 separate vulnerabilities identified through Common Vulnerabilities and Exposures reporting. They're designed to resolve these issues one by one in relevant components.
A particularly nasty vulnerability exists within the Windows Server Update Service component. It carries a CVSS score of 8.1, meaning it's rated highly for severity because attackers could potentially exploit it remotely without needing any user interaction; that makes it especially concerning since users might not even be aware it's happening.
While the SQL Server update covers multiple flaws ranging from lower to higher impact levels, other affected areas include Windows Management Services and Windows Hello. The list also extends to components like LSASS (Local Security Authority Subsystem Service).
Notably, there's an issue in NTFS with a CVSS score of 7.8; attackers could leverage that flaw for potentially more widespread or targeted attacks than lower-scored flaws.
Two vulnerabilities are listed specifically within the Routing and Remote Access Service, RRAS, carrying CVSS scores of 7.8 and 8.8, respectively, suggesting these specific issues warrant close attention due to their potential risk level.
Security Update Guide - Microsoft Security Response Center
Tag CVE Base Score Exploitability Windows Deployment Services CVE-2026-0386 7.5 Exploitation Unlikely SQL Server CVE-2026-20803 7.2 Exploitation Less Likely Windows Hello CVE-2026-20804 7.7 Exploitation Unlikely Desktop Window Manager CVE-2026-20805 5.5 Exploitation Detected Printer Association Object CVE-2026-20808 7.0 Exploitation Less Likely Windows Kernel Memory CVE-2026-20809 7.8 Exploitation Less Likely Windows Ancillary Function Driver for WinSock CVE-2026-20810 7.8 Exploitation Less Likely Windows Win32K - ICOMP CVE-2026-20811 7.8 Exploitation Less Likely Windows LDAP - Lightweight Directory Access Protocol CVE-2026-20812 6.5 Exploitation Less Likely Graphics Kernel CVE-2026-20814 7.0 Exploitation Less Likely Capability Access Management Service (camsvc) CVE-2026-20815 7.0 Exploitation Less Likely Windows Installer CVE-2026-20816 7.8 Exploitation More Likely Windows Error Reporting CVE-2026-20817 7.8 Exploitation More Likely Windows Kernel CVE-2026-20818 6.2 Exploitation Unlikely Windows Virtualization-Based Security (VBS) Enclave CVE-2026-20819 5.5 Exploitation Less Likely Windows Common Log File System Driver CVE-2026-20820 7.8 Exploitation More Likely Windows Remote Procedure Call CVE-2026-20821 6.2 Exploitation Unlikely Microsoft Graphics Component CVE-2026-20822 7.8 Exploitation Less Likely Windows File Explorer CVE-2026-20823 5.5 Exploitation Unlikely Windows Remote Assistance CVE-2026-20824 5.5 Exploitation Less Likely Windows Hyper-V CVE-2026-20825 4.4 Exploitation Less Likely Tablet Windows User Interface (TWINUI) Subsystem CVE-2026-20826 7.8 Exploitation Less Likely Tablet Windows User Interface (TWINUI) Subsystem CVE-2026-20827 5.5 Exploitation Unlikely Windows Internet Connection Sharing (ICS) CVE-2026-20828 4.6 Exploitation Less Likely Windows TPM CVE-2026-20829 5.5 Exploitation Less Likely Capability Access Management Service (camsvc) CVE-2026-20830 7.0 Exploitation Unlikely Windows Ancillary Function Driver for WinSock CVE-2026-20831 7.8 Exploitation Less Likely Windows Remote Procedure Call Interface Definition Language (IDL) CVE-2026-20832 7.8 Exploitation Less Likely Windows Kerberos CVE-2026-20833 5.5 Exploitation Less Likely Windows Shell CVE-2026-20834 4.6 Exploitation Less Likely Capability Access Management Service (camsvc) CVE-2026-20835 5.5 Exploitation Less Likely Graphics Kernel CVE-2026-20836 7.0 Exploitation Less Likely Windows Media CVE-2026-20837 7.8 Exploitation Less Likely Windows Kernel CVE-2026-20838 5.5 Exploitation Less Likely Windows Client-Side Caching (CSC) Service CVE-2026-20839 5.5 Exploitation Unlikely Windows NTFS CVE-2026-20840 7.8 Exploitation More Likely Windows DWM CVE-2026-20842 7.0 Exploitation Less Likely Windows Routing and Remote Access Service (RRAS) CVE-2026-20843 7.8 Exploitation More Likely Windows Clipboard Server CVE-2026-20844 7.4 Exploitation Less Likely Windows Shell CVE-2026-20847 6.5 Exploitation Unlikely Windows SMB Server CVE-2026-20848 7.5 Exploitation Unlikely Windows Kerberos CVE-2026-20849 7.5 Exploitation Unlikely Capability Access Management Service (camsvc) CVE-2026-20851 6.2 Exploitation Less Likely Windows Hello CVE-2026-20852 7.7 Exploitation Less Likely Windows WalletService CVE-2026-20853 7.4 Exploitation Less Likely Windows Local Security Authority Subsystem Service (LSASS) CVE-2026-20854 7.5 Exploitation Less Likely Windows Server Update Service CVE-2026-20856 8.1 Exploitation Less Likely Windows Cloud Files Mini Filter Driver CVE-2026-20857 7.8 Exploitation Unlikely Windows Management Services CVE-2026-20858 7.8 Exploitation Less Likely Windows Kernel-Mode Drivers CVE-2026-20859 7.8 Exploitation Less Likely Windows Ancillary Function Driver for WinSock CVE-2026-20860 7.8 Exploitation More Likely Windows Management Services CVE-2026-20861 7.8 Exploitation Less Likely Windows Management Services CVE-2026-20862 5.5 Exploitation Unlikely Windows Win32K - ICOMP CVE-2026-20863 7.0 Exploitation Less Likely Connected Devices Platform Service (Cdpsvc) CVE-2026-20864 7.8 Exploitation Unlikely Windows Management Services CVE-2026-20865 7.8 Exploitation Less Likely Windows Management Services CVE-2026-20866 7.8 Exploitation Less Likely Windows Management Services CVE-2026-20867 7.8 Exploitation Unlikely Windows Routing and Remote Access Service (RRAS) CVE-2026-20868 8.8 Exploitation Less Likely Windows Local Session Manager (LSM) CVE-2026-20869 7.0 Exploitation Less Likely Windows Win32K - ICOMP CVE-2026-20870 7.8 Exploitation Less Likely Desktop Window Manager CVE-2026-20871 7.8 Exploitation More Likely Windows NTLM CVE-2026-20872 6.5 Exploitation Less Likely Windows Management Services CVE-2026-20873 7.8 Exploitation Less Likely Windows Management Services CVE-2026-20874 7.8 Exploitation Less Likely Windows Local Security Authority Subsystem Service (LSASS) CVE-2026-20875 7.5 Exploitation Less Likely Windows Virtualization-Based Security (VBS) Enclave CVE-2026-20876 6.7 Exploitation Less Likely Windows Management Services CVE-2026-20877 7.8 Exploitation Less Likely Windows Management Services CVE-2026-20918 7.8 Exploitation Unlikely Windows SMB Server CVE-2026-20919 7.5 Exploitation Unlikely Windows Win32K - ICOMP CVE-2026-20920 7.8 Exploitation Unlikely Windows SMB Server CVE-2026-20921 7.5 Exploitation Unlikely Windows NTFS CVE-2026-20922 7.8 Exploitation More Likely Windows Management Services CVE-2026-20923 7.8 Exploitation Less Likely Windows Management Services CVE-2026-20924 7.8 Exploitation Less Likely Windows NTLM CVE-2026-20925 6.5 Exploitation Less Likely Windows SMB Server CVE-2026-20926 7.5 Exploitation Unlikely Windows SMB Server CVE-2026-20927 5.3 Exploitation Unlikely Windows HTTP.sys CVE-2026-20929 7.5 Exploitation Unlikely Windows Telephony Service CVE-2026-20931 8.0 Exploitation Unlikely Windows File Explorer CVE-2026-20932 5.5 Exploitation Unlikely Windows SMB Server CVE-2026-20934 7.5 Exploitation Unlikely Windows Virtualization-Based Security (VBS) Enclave CVE-2026-20935 6.2 Exploitation Less Likely Windows NDIS CVE-2026-20936 4.3 Exploitation Unlikely Windows File Explorer CVE-2026-20937 5.5 Exploitation Unlikely Windows Virtualization-Based Security (VBS) Enclave CVE-2026-20938 7.8 Exploitation Less Likely Windows File Explorer CVE-2026-20939 5.5 Exploitation Unlikely Windows Cloud Files Mini Filter Driver CVE-2026-20940 7.8 Exploitation Unlikely Host Process for Windows Tasks CVE-2026-20941 7.8 Exploitation Less Likely Microsoft Office CVE-2026-20943 7.0 Exploitation Less Likely Microsoft Office Word CVE-2026-20944 8.4 Exploitation Less Likely Microsoft Office Excel CVE-2026-20946 7.8 Exploitation Less Likely Microsoft Office SharePoint CVE-2026-20947 8.8 Exploitation Unlikely Microsoft Office Word CVE-2026-20948 7.8 Exploitation Less Likely Microsoft Office Excel CVE-2026-20949 7.8 Exploitation Less Likely Microsoft Office Excel CVE-2026-20950 7.8 Exploitation Less Likely Microsoft Office SharePoint CVE-2026-20951 7.8 Exploitation Less Likely Microsoft Office CVE-2026-20952 8.4 Exploitation Less Likely Microsoft Office CVE-2026-20953 8.4 Exploitation Less Likely Microsoft Office Excel CVE-2026-20955 7.8 Exploitation Less Likely Microsoft Office Excel CVE-2026-20956 7.8 Exploitation Less Likely Microsoft Office Excel CVE-2026-20957 7.8 Exploitation Less Likely Microsoft Office SharePoint CVE-2026-20958 5.4 Exploitation Less Likely Microsoft Office SharePoint CVE-2026-20959 4.6 Exploitation Less Likely Dynamic Root of Trust for Measurement (DRTM) CVE-2026-20962 4.4 Exploitation Less Likely Microsoft Office SharePoint CVE-2026-20963 8.8 Exploitation Less Likely Windows Admin Center CVE-2026-20965 7.5 Exploitation Less Likely Inbox COM Objects CVE-2026-21219 7.0 Exploitation Unlikely Capability Access Management Service (camsvc) CVE-2026-21221 7.0 Exploitation Unlikely Azure Connected Machine Agent CVE-2026-21224 7.8 Exploitation Less Likely Azure Core shared client library for Python CVE-2026-21226 7.5 Exploitation Less Likely Windows Secure Boot CVE-2026-21265 6.4 Exploitation Less Likely
