January's first 2026 security update rolled out to address 114 flaws in Windows: Eight are rated critical and 106 have been deemed important. However, the one that is of most concern has already been exploited in the wild
Tracked as CVE-2026-20805 and with a CVSS score of 5.5, this information disclosure flaw impacts the Desktop Windows Manager. The Microsoft Threat Intelligence Center and Security Response Center teams were responsible for identifying and reporting the flaw, but there is no additional information about how it’s being used by cybercriminals or which group is exploiting it.
Microsoft's advisory states that if an unauthorized user is allowed to access sensitive information in the Desktop Windows Manager, they could disclose that information locally. "The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a section address from a remote ALPC port, with is user-mode memory."
