# KB5073696: January 2026 security update KB5073696, released January 13, 2026, fixes 37 CVEs across 2 products. One of them is being exploited (CVE-2026-20805); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5073696 - Platform: Microsoft - Released: Jan 13, 2026 - Priority: Patch now (Closes CVE-2026-20805, exploited (CISA KEV)) - CVEs: 37, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://support.microsoft.com/help/5073696 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2012 R2](https://patchblox.com/security/data/product/microsoft/windows-server-2012-r2.md) | | | | [Windows Server 2012 R2 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2012-r2-server-core-installation.md) | | | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-20805](https://patchblox.com/security/data/cve/CVE-2026-20805.md) | Patch now | Desktop Window Manager | 5.5 | 0.0746 | CISA KEV | | [CVE-2026-20860](https://patchblox.com/security/data/cve/CVE-2026-20860.md) | Urgent | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0828 | More likely | | [CVE-2026-20840](https://patchblox.com/security/data/cve/CVE-2026-20840.md) | Urgent | Windows NTFS | 7.8 | 0.0459 | More likely | | [CVE-2026-20843](https://patchblox.com/security/data/cve/CVE-2026-20843.md) | Urgent | Windows Routing and Remote Access Service (RRAS) | 7.8 | 0.0342 | More likely | | [CVE-2026-20820](https://patchblox.com/security/data/cve/CVE-2026-20820.md) | Urgent | Windows Common Log File System Driver | 7.8 | 0.0256 | More likely | | [CVE-2026-20816](https://patchblox.com/security/data/cve/CVE-2026-20816.md) | Urgent | Windows Installer | 7.8 | 0.0244 | More likely | | [CVE-2026-20922](https://patchblox.com/security/data/cve/CVE-2026-20922.md) | Urgent | Windows NTFS | 7.8 | 0.0108 | More likely | | [CVE-2023-31096](https://patchblox.com/security/data/cve/CVE-2023-31096.md) | Urgent | Agere Windows Modem Driver | 7.8 | 0.0048 | Disclosed | | [CVE-2026-20929](https://patchblox.com/security/data/cve/CVE-2026-20929.md) | High | Windows HTTP.sys | 7.5 | 0.0287 | | | [CVE-2026-20875](https://patchblox.com/security/data/cve/CVE-2026-20875.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 7.5 | 0.0154 | | | [CVE-2026-20868](https://patchblox.com/security/data/cve/CVE-2026-20868.md) | High | Windows Routing and Remote Access Service (RRAS) | 8.8 | 0.0139 | | | [CVE-2026-20921](https://patchblox.com/security/data/cve/CVE-2026-20921.md) | High | Windows SMB Server | 7.5 | 0.0118 | | | [CVE-2024-55414](https://patchblox.com/security/data/cve/CVE-2024-55414.md) | High | Windows Motorola Soft Modem Driver | 7.8 | 0.0114 | | | [CVE-2026-20856](https://patchblox.com/security/data/cve/CVE-2026-20856.md) | High | Windows Server Update Service | 8.1 | 0.0112 | | | [CVE-2026-20849](https://patchblox.com/security/data/cve/CVE-2026-20849.md) | High | Windows Kerberos | 7.5 | 0.0101 | | | [CVE-2026-20931](https://patchblox.com/security/data/cve/CVE-2026-20931.md) | High | Windows Telephony Service | 8.0 | 0.0085 | | | [CVE-2026-20919](https://patchblox.com/security/data/cve/CVE-2026-20919.md) | High | Windows SMB Server | 7.5 | 0.0080 | | | [CVE-2026-20926](https://patchblox.com/security/data/cve/CVE-2026-20926.md) | High | Windows SMB Server | 7.5 | 0.0080 | | | [CVE-2026-20848](https://patchblox.com/security/data/cve/CVE-2026-20848.md) | High | Windows SMB Server | 7.5 | 0.0075 | | | [CVE-2026-20934](https://patchblox.com/security/data/cve/CVE-2026-20934.md) | High | Windows SMB Server | 7.5 | 0.0075 | | | [CVE-2026-0386](https://patchblox.com/security/data/cve/CVE-2026-0386.md) | High | Windows Deployment Services | 7.5 | 0.0055 | | | [CVE-2026-20940](https://patchblox.com/security/data/cve/CVE-2026-20940.md) | High | Windows Cloud Files Mini Filter Driver | 7.8 | 0.0046 | | | [CVE-2026-20809](https://patchblox.com/security/data/cve/CVE-2026-20809.md) | High | Windows Kernel Memory | 7.8 | 0.0036 | | | [CVE-2026-20831](https://patchblox.com/security/data/cve/CVE-2026-20831.md) | High | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0030 | | | [CVE-2026-20869](https://patchblox.com/security/data/cve/CVE-2026-20869.md) | High | Windows Local Session Manager (LSM) | 7.0 | 0.0029 | | | [CVE-2026-20872](https://patchblox.com/security/data/cve/CVE-2026-20872.md) | Routine | Windows NTLM | 6.5 | 0.1979 | | | [CVE-2026-20925](https://patchblox.com/security/data/cve/CVE-2026-20925.md) | Routine | Windows NTLM | 6.5 | 0.1793 | | | [CVE-2026-20847](https://patchblox.com/security/data/cve/CVE-2026-20847.md) | Routine | Windows Shell | 6.5 | 0.0134 | | | [CVE-2026-21265](https://patchblox.com/security/data/cve/CVE-2026-21265.md) | Routine | Windows Secure Boot | 6.4 | 0.0110 | Disclosed | | [CVE-2026-20927](https://patchblox.com/security/data/cve/CVE-2026-20927.md) | Routine | Windows SMB Server | 5.3 | 0.0091 | | | [CVE-2026-20824](https://patchblox.com/security/data/cve/CVE-2026-20824.md) | Routine | Windows Remote Assistance | 5.5 | 0.0086 | | | [CVE-2026-20834](https://patchblox.com/security/data/cve/CVE-2026-20834.md) | Routine | Windows Shell | 4.6 | 0.0074 | | | [CVE-2026-20821](https://patchblox.com/security/data/cve/CVE-2026-20821.md) | Routine | Windows Remote Procedure Call | 6.2 | 0.0070 | | | [CVE-2026-20828](https://patchblox.com/security/data/cve/CVE-2026-20828.md) | Routine | Windows Internet Connection Sharing (ICS) | 4.6 | 0.0064 | | | [CVE-2026-20833](https://patchblox.com/security/data/cve/CVE-2026-20833.md) | Routine | Windows Kerberos | 5.5 | 0.0053 | | | [CVE-2026-20936](https://patchblox.com/security/data/cve/CVE-2026-20936.md) | Routine | Windows NDIS | 4.3 | 0.0048 | | | [CVE-2026-20839](https://patchblox.com/security/data/cve/CVE-2026-20839.md) | Routine | Windows Client-Side Caching (CSC) Service | 5.5 | 0.0048 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo