Microsoft Patch Tuesday, January 2026: the CVEs, page 2

Microsoft Patch Tuesday January 2026: the CVEs Microsoft published on 13 January 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 7.0CVE-2026-20816EPSS 2.4%2026-01-13

   Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

2. 7.0CVE-2026-20815EPSS 0.3%2026-01-13

   Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.

3. 7.0CVE-2026-20814EPSS 0.3%2026-01-13

   Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally.

4. 6.5CVE-2026-20812EPSS 1.1%2026-01-13

   Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.

5. 7.8CVE-2026-20811EPSS 0.5%2026-01-13

   Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.

6. 7.8CVE-2026-20810EPSS 0.5%2026-01-13

   Free of memory not on the heap in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

7. 7.8CVE-2026-20809EPSS 0.4%2026-01-13

   Time-of-check time-of-use (toctou) race condition in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.

8. 7.0CVE-2026-20808EPSS 0.3%2026-01-13

   Concurrent execution using shared resource with improper synchronization ('race condition') in Printer Association Object allows an authorized attacker to elevate privileges locally.

9. 5.5CVE-2026-20805KEVEPSS 7.5%2026-01-13

   Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

10. 7.7CVE-2026-20804EPSS 0.5%2026-01-13

    Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.

11. 7.2CVE-2026-20803EPSS 1.2%2026-01-13

    Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.

12. 7.5CVE-2026-0386EPSS 0.5%2026-01-13

    Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.