# KB5074109: January 2026 cumulative update for Windows 11 24H2 KB5074109, released January 13, 2026, fixes 85 CVEs across 4 products. One of them is being exploited (CVE-2026-20805); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5074109 - Platform: Microsoft - Released: Jan 13, 2026 - Priority: Patch now (Closes CVE-2026-20805, exploited (CISA KEV)) - CVEs: 85, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://support.microsoft.com/help/5074109 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows 11 Version 24H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-24h2-for-arm64-based-systems.md) | | | | [Windows 11 Version 24H2 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-24h2-for-x64-based-systems.md) | | | | [Windows 11 Version 25H2 for ARM64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-25h2-for-arm64-based-systems.md) | | | | [Windows 11 Version 25H2 for x64-based Systems](https://patchblox.com/security/data/product/microsoft/windows-11-version-25h2-for-x64-based-systems.md) | | | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-20805](https://patchblox.com/security/data/cve/CVE-2026-20805.md) | Patch now | Desktop Window Manager | 5.5 | 0.0746 | CISA KEV | | [CVE-2026-20860](https://patchblox.com/security/data/cve/CVE-2026-20860.md) | Urgent | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0828 | More likely | | [CVE-2026-20817](https://patchblox.com/security/data/cve/CVE-2026-20817.md) | Urgent | Windows Error Reporting | 7.8 | 0.0542 | More likely | | [CVE-2026-20840](https://patchblox.com/security/data/cve/CVE-2026-20840.md) | Urgent | Windows NTFS | 7.8 | 0.0459 | More likely | | [CVE-2026-20871](https://patchblox.com/security/data/cve/CVE-2026-20871.md) | Urgent | Desktop Window Manager | 7.8 | 0.0414 | More likely | | [CVE-2026-20843](https://patchblox.com/security/data/cve/CVE-2026-20843.md) | Urgent | Windows Routing and Remote Access Service (RRAS) | 7.8 | 0.0342 | More likely | | [CVE-2026-20820](https://patchblox.com/security/data/cve/CVE-2026-20820.md) | Urgent | Windows Common Log File System Driver | 7.8 | 0.0256 | More likely | | [CVE-2026-20816](https://patchblox.com/security/data/cve/CVE-2026-20816.md) | Urgent | Windows Installer | 7.8 | 0.0244 | More likely | | [CVE-2026-20922](https://patchblox.com/security/data/cve/CVE-2026-20922.md) | Urgent | Windows NTFS | 7.8 | 0.0108 | More likely | | [CVE-2026-20854](https://patchblox.com/security/data/cve/CVE-2026-20854.md) | Urgent | Windows Local Security Authority Subsystem Service (LSASS) | 7.5 | 0.0108 | | | [CVE-2026-20876](https://patchblox.com/security/data/cve/CVE-2026-20876.md) | Urgent | Windows Virtualization-Based Security (VBS) Enclave | 6.7 | 0.0051 | | | [CVE-2023-31096](https://patchblox.com/security/data/cve/CVE-2023-31096.md) | Urgent | Agere Windows Modem Driver | 7.8 | 0.0048 | Disclosed | | [CVE-2026-20822](https://patchblox.com/security/data/cve/CVE-2026-20822.md) | Urgent | Microsoft Graphics Component | 7.8 | 0.0039 | | | [CVE-2026-20875](https://patchblox.com/security/data/cve/CVE-2026-20875.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 7.5 | 0.0154 | | | [CVE-2026-20868](https://patchblox.com/security/data/cve/CVE-2026-20868.md) | High | Windows Routing and Remote Access Service (RRAS) | 8.8 | 0.0139 | | | [CVE-2026-20921](https://patchblox.com/security/data/cve/CVE-2026-20921.md) | High | Windows SMB Server | 7.5 | 0.0118 | | | [CVE-2024-55414](https://patchblox.com/security/data/cve/CVE-2024-55414.md) | High | Windows Motorola Soft Modem Driver | 7.8 | 0.0114 | | | [CVE-2026-20856](https://patchblox.com/security/data/cve/CVE-2026-20856.md) | High | Windows Server Update Service | 8.1 | 0.0112 | | | [CVE-2026-20849](https://patchblox.com/security/data/cve/CVE-2026-20849.md) | High | Windows Kerberos | 7.5 | 0.0101 | | | [CVE-2026-20931](https://patchblox.com/security/data/cve/CVE-2026-20931.md) | High | Windows Telephony Service | 8.0 | 0.0085 | | | [CVE-2026-20919](https://patchblox.com/security/data/cve/CVE-2026-20919.md) | High | Windows SMB Server | 7.5 | 0.0080 | | | [CVE-2026-20926](https://patchblox.com/security/data/cve/CVE-2026-20926.md) | High | Windows SMB Server | 7.5 | 0.0080 | | | [CVE-2026-20848](https://patchblox.com/security/data/cve/CVE-2026-20848.md) | High | Windows SMB Server | 7.5 | 0.0075 | | | [CVE-2026-20934](https://patchblox.com/security/data/cve/CVE-2026-20934.md) | High | Windows SMB Server | 7.5 | 0.0075 | | | [CVE-2026-20837](https://patchblox.com/security/data/cve/CVE-2026-20837.md) | High | Windows Media | 7.8 | 0.0068 | | | [CVE-2026-20864](https://patchblox.com/security/data/cve/CVE-2026-20864.md) | High | Connected Devices Platform Service (Cdpsvc) | 7.8 | 0.0055 | | | [CVE-2026-20804](https://patchblox.com/security/data/cve/CVE-2026-20804.md) | High | Windows Hello | 7.7 | 0.0050 | | | [CVE-2026-20852](https://patchblox.com/security/data/cve/CVE-2026-20852.md) | High | Windows Hello | 7.7 | 0.0050 | | | [CVE-2026-20811](https://patchblox.com/security/data/cve/CVE-2026-20811.md) | High | Windows Win32K - ICOMP | 7.8 | 0.0049 | | | [CVE-2026-20832](https://patchblox.com/security/data/cve/CVE-2026-20832.md) | High | Windows Remote Procedure Call Interface Definition Language (IDL) | 7.8 | 0.0048 | | | [CVE-2026-20857](https://patchblox.com/security/data/cve/CVE-2026-20857.md) | High | Windows Cloud Files Mini Filter Driver | 7.8 | 0.0048 | | | [CVE-2026-20859](https://patchblox.com/security/data/cve/CVE-2026-20859.md) | High | Windows Kernel-Mode Drivers | 7.8 | 0.0048 | | | [CVE-2026-20941](https://patchblox.com/security/data/cve/CVE-2026-20941.md) | High | Host Process for Windows Tasks | 7.8 | 0.0048 | | | [CVE-2026-20870](https://patchblox.com/security/data/cve/CVE-2026-20870.md) | High | Windows Win32K - ICOMP | 7.8 | 0.0047 | | | [CVE-2026-20938](https://patchblox.com/security/data/cve/CVE-2026-20938.md) | High | Windows Virtualization-Based Security (VBS) Enclave | 7.8 | 0.0047 | | | [CVE-2026-20923](https://patchblox.com/security/data/cve/CVE-2026-20923.md) | High | Windows Management Services | 7.8 | 0.0040 | | | [CVE-2026-20865](https://patchblox.com/security/data/cve/CVE-2026-20865.md) | High | Windows Management Services | 7.8 | 0.0039 | | | [CVE-2026-20863](https://patchblox.com/security/data/cve/CVE-2026-20863.md) | High | Windows Win32K - ICOMP | 7.0 | 0.0039 | | | [CVE-2026-20842](https://patchblox.com/security/data/cve/CVE-2026-20842.md) | High | Windows DWM | 7.0 | 0.0039 | | | [CVE-2026-20809](https://patchblox.com/security/data/cve/CVE-2026-20809.md) | High | Windows Kernel Memory | 7.8 | 0.0036 | | | [CVE-2026-20844](https://patchblox.com/security/data/cve/CVE-2026-20844.md) | High | Windows Clipboard Server | 7.4 | 0.0032 | | | [CVE-2026-20853](https://patchblox.com/security/data/cve/CVE-2026-20853.md) | High | Windows WalletService | 7.4 | 0.0031 | | | [CVE-2026-20877](https://patchblox.com/security/data/cve/CVE-2026-20877.md) | High | Windows Management Services | 7.8 | 0.0030 | | | [CVE-2026-20918](https://patchblox.com/security/data/cve/CVE-2026-20918.md) | High | Windows Management Services | 7.8 | 0.0030 | | | [CVE-2026-20924](https://patchblox.com/security/data/cve/CVE-2026-20924.md) | High | Windows Management Services | 7.8 | 0.0030 | | | [CVE-2026-20826](https://patchblox.com/security/data/cve/CVE-2026-20826.md) | High | Tablet Windows User Interface (TWINUI) Subsystem | 7.8 | 0.0030 | | | [CVE-2026-20831](https://patchblox.com/security/data/cve/CVE-2026-20831.md) | High | Windows Ancillary Function Driver for WinSock | 7.8 | 0.0030 | | | [CVE-2026-20858](https://patchblox.com/security/data/cve/CVE-2026-20858.md) | High | Windows Management Services | 7.8 | 0.0029 | | | [CVE-2026-20861](https://patchblox.com/security/data/cve/CVE-2026-20861.md) | High | Windows Management Services | 7.8 | 0.0029 | | | [CVE-2026-20866](https://patchblox.com/security/data/cve/CVE-2026-20866.md) | High | Windows Management Services | 7.8 | 0.0029 | | | [CVE-2026-20867](https://patchblox.com/security/data/cve/CVE-2026-20867.md) | High | Windows Management Services | 7.8 | 0.0029 | | | [CVE-2026-20873](https://patchblox.com/security/data/cve/CVE-2026-20873.md) | High | Windows Management Services | 7.8 | 0.0029 | | | [CVE-2026-20874](https://patchblox.com/security/data/cve/CVE-2026-20874.md) | High | Windows Management Services | 7.8 | 0.0029 | | | [CVE-2026-20808](https://patchblox.com/security/data/cve/CVE-2026-20808.md) | High | Printer Association Object | 7.0 | 0.0029 | | | [CVE-2026-20814](https://patchblox.com/security/data/cve/CVE-2026-20814.md) | High | Graphics Kernel | 7.0 | 0.0029 | | | [CVE-2026-20815](https://patchblox.com/security/data/cve/CVE-2026-20815.md) | High | Capability Access Management Service (camsvc) | 7.0 | 0.0029 | | | [CVE-2026-20869](https://patchblox.com/security/data/cve/CVE-2026-20869.md) | High | Windows Local Session Manager (LSM) | 7.0 | 0.0029 | | | [CVE-2026-20836](https://patchblox.com/security/data/cve/CVE-2026-20836.md) | High | Graphics Kernel | 7.0 | 0.0029 | | | [CVE-2026-21221](https://patchblox.com/security/data/cve/CVE-2026-21221.md) | High | Capability Access Management Service (camsvc) | 7.0 | 0.0024 | | | [CVE-2026-20872](https://patchblox.com/security/data/cve/CVE-2026-20872.md) | Routine | Windows NTLM | 6.5 | 0.1979 | | | [CVE-2026-20925](https://patchblox.com/security/data/cve/CVE-2026-20925.md) | Routine | Windows NTLM | 6.5 | 0.1793 | | | [CVE-2026-20847](https://patchblox.com/security/data/cve/CVE-2026-20847.md) | Routine | Windows Shell | 6.5 | 0.0134 | | | [CVE-2026-20812](https://patchblox.com/security/data/cve/CVE-2026-20812.md) | Routine | Windows LDAP - Lightweight Directory Access Protocol | 6.5 | 0.0112 | | | [CVE-2026-21265](https://patchblox.com/security/data/cve/CVE-2026-21265.md) | Routine | Windows Secure Boot | 6.4 | 0.0110 | Disclosed | | [CVE-2026-20927](https://patchblox.com/security/data/cve/CVE-2026-20927.md) | Routine | Windows SMB Server | 5.3 | 0.0091 | | | [CVE-2026-20824](https://patchblox.com/security/data/cve/CVE-2026-20824.md) | Routine | Windows Remote Assistance | 5.5 | 0.0086 | | | [CVE-2026-20834](https://patchblox.com/security/data/cve/CVE-2026-20834.md) | Routine | Windows Shell | 4.6 | 0.0074 | | | [CVE-2026-20821](https://patchblox.com/security/data/cve/CVE-2026-20821.md) | Routine | Windows Remote Procedure Call | 6.2 | 0.0070 | | | [CVE-2026-20932](https://patchblox.com/security/data/cve/CVE-2026-20932.md) | Routine | Windows File Explorer | 5.5 | 0.0068 | | | [CVE-2026-20823](https://patchblox.com/security/data/cve/CVE-2026-20823.md) | Routine | Windows File Explorer | 5.5 | 0.0066 | | | [CVE-2026-20827](https://patchblox.com/security/data/cve/CVE-2026-20827.md) | Routine | Tablet Windows User Interface (TWINUI) Subsystem | 5.5 | 0.0066 | | | [CVE-2026-20838](https://patchblox.com/security/data/cve/CVE-2026-20838.md) | Routine | Windows Kernel | 5.5 | 0.0065 | | | [CVE-2026-20828](https://patchblox.com/security/data/cve/CVE-2026-20828.md) | Routine | Windows Internet Connection Sharing (ICS) | 4.6 | 0.0064 | | | [CVE-2026-20862](https://patchblox.com/security/data/cve/CVE-2026-20862.md) | Routine | Windows Management Services | 5.5 | 0.0064 | | | [CVE-2026-20851](https://patchblox.com/security/data/cve/CVE-2026-20851.md) | Routine | Capability Access Management Service (camsvc) | 6.2 | 0.0059 | | | [CVE-2026-20829](https://patchblox.com/security/data/cve/CVE-2026-20829.md) | Routine | Windows TPM | 5.5 | 0.0056 | | | [CVE-2026-20835](https://patchblox.com/security/data/cve/CVE-2026-20835.md) | Routine | Capability Access Management Service (camsvc) | 5.5 | 0.0056 | | | [CVE-2026-20819](https://patchblox.com/security/data/cve/CVE-2026-20819.md) | Routine | Windows Virtualization-Based Security (VBS) Enclave | 5.5 | 0.0054 | | | [CVE-2026-20825](https://patchblox.com/security/data/cve/CVE-2026-20825.md) | Routine | Windows Hyper-V | 4.4 | 0.0053 | | | [CVE-2026-20939](https://patchblox.com/security/data/cve/CVE-2026-20939.md) | Routine | Windows File Explorer | 5.5 | 0.0051 | | | [CVE-2026-20937](https://patchblox.com/security/data/cve/CVE-2026-20937.md) | Routine | Windows File Explorer | 5.5 | 0.0051 | | | [CVE-2026-20936](https://patchblox.com/security/data/cve/CVE-2026-20936.md) | Routine | Windows NDIS | 4.3 | 0.0048 | | | [CVE-2026-20839](https://patchblox.com/security/data/cve/CVE-2026-20839.md) | Routine | Windows Client-Side Caching (CSC) Service | 5.5 | 0.0048 | | | [CVE-2026-20962](https://patchblox.com/security/data/cve/CVE-2026-20962.md) | Routine | Dynamic Root of Trust for Measurement (DRTM) | 4.4 | 0.0044 | | | [CVE-2026-20935](https://patchblox.com/security/data/cve/CVE-2026-20935.md) | Routine | Windows Virtualization-Based Security (VBS) Enclave | 6.2 | 0.0044 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo