Microsoft Patch Tuesday, January 2026: the CVEs
Filter
Microsoft Patch Tuesday January 2026: the CVEs Microsoft published on 13 January 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 9.8CVE-2026-20963KEVEPSS 29%
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- 5.5CVE-2026-20805KEVEPSS 7.5%
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.