Microsoft · Security update · January 13, 2026

KB5074109: January 2026 cumulative update for Windows 11 24H2

KB5074109, released January 13, 2026, fixes 85 CVEs across 4 products. One of them is being exploited (CVE-2026-20805); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV2 publicly disclosed
CVEs closed
85
3 rated Critical
Exploited
1
CVE-2026-20805
Exploitation more likely
9
Vendor assessment
Highest EPSS
0.1979
97th percentile

Priority of the 85 CVEs

Patch now 1 Urgent 12 High 46 Routine 26

Applies to

Product
Windows 11 Version 24H2 for ARM64-based Systems
Windows 11 Version 24H2 for x64-based Systems
Windows 11 Version 25H2 for ARM64-based Systems
Windows 11 Version 25H2 for x64-based Systems

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2026-20805 Desktop Window Manager Information Disclosure 5.5 0.0746 KEVExploited
Urgent CVE-2026-20860 Windows Ancillary Function Driver for WinSock Elevation of Privilege 7.8 0.0828 More likely
Urgent CVE-2026-20817 Windows Error Reporting Elevation of Privilege 7.8 0.0542 More likely
Urgent CVE-2026-20840 Windows NTFS Remote Code Execution 7.8 0.0459 More likely
Urgent CVE-2026-20871 Desktop Window Manager Elevation of Privilege 7.8 0.0414 More likely
Urgent CVE-2026-20843 Windows Routing and Remote Access Service (RRAS) Elevation of Privilege 7.8 0.0342 More likely
Urgent CVE-2026-20820 Windows Common Log File System Driver Elevation of Privilege 7.8 0.0256 More likely
Urgent CVE-2026-20816 Windows Installer Elevation of Privilege 7.8 0.0244 More likely
Urgent CVE-2026-20922 Windows NTFS Remote Code Execution 7.8 0.0108 More likely
Urgent CVE-2026-20854 Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution 7.5 0.0108 Exploitation Less Likely
Urgent CVE-2026-20876 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege 6.7 0.0051 Exploitation Less Likely
Urgent CVE-2023-31096 Agere Windows Modem Driver Elevation of Privilege 7.8 0.0048 DisclosedMore likely
Urgent CVE-2026-20822 Microsoft Graphics Component Elevation of Privilege 7.8 0.0039 Exploitation Less Likely
High CVE-2026-20875 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service 7.5 0.0154 Exploitation Less Likely
High CVE-2026-20868 Windows Routing and Remote Access Service (RRAS) Remote Code Execution 8.8 0.0139 Exploitation Less Likely
High CVE-2026-20921 Windows SMB Server Elevation of Privilege 7.5 0.0118 Exploitation Unlikely
High CVE-2024-55414 Windows Motorola Soft Modem Driver Elevation of Privilege 7.8 0.0114 Exploitation Unlikely
High CVE-2026-20856 Windows Server Update Service Remote Code Execution 8.1 0.0112 Exploitation Less Likely
High CVE-2026-20849 Windows Kerberos Elevation of Privilege 7.5 0.0101 Exploitation Unlikely
High CVE-2026-20931 Windows Telephony Service Elevation of Privilege 8.0 0.0085 Exploitation Unlikely
High CVE-2026-20919 Windows SMB Server Elevation of Privilege 7.5 0.0080 Exploitation Unlikely
High CVE-2026-20926 Windows SMB Server Elevation of Privilege 7.5 0.0080 Exploitation Unlikely
High CVE-2026-20848 Windows SMB Server Elevation of Privilege 7.5 0.0075 Exploitation Unlikely
High CVE-2026-20934 Windows SMB Server Elevation of Privilege 7.5 0.0075 Exploitation Unlikely
High CVE-2026-20837 Windows Media Remote Code Execution 7.8 0.0068 Exploitation Less Likely
Showing 1 to 25 of 85 1Next