Monthly Fallout Report
January 2026 Fallout
114 vulnerabilities, one zero-day in the wild, and KB5074109 delivering boot loops, restart-instead-of-shutdown bugs, Outlook freezes, and Nvidia GPU glitches — Microsoft needed TWO emergency OOB patches to clean up this mess.
Tired of patch chaos? Automox automates patching across Windows, Mac, and Linux — so you're never caught off guard on Patch Tuesday.
Try Free →Fallout Timeline
January 2026 kicks off the new year with 114 vulnerabilities — the third-largest January Patch Tuesday on record. One actively exploited zero-day: CVE-2026-20805, an information disclosure flaw in the Desktop Window Manager (DWM) that leaks memory addresses, letting attackers defeat ASLR and set up multi-stage attacks. DWM has been patched 20+ times since 2022; this is the first exploited-in-wild DWM zero-day. Microsoft Threat Intelligence confirmed active exploitation. Two publicly disclosed zero-days: CVE-2026-21265 (Secure Boot certificate expiration bypass — Microsoft begins rolling out 2026 replacements for 2011-era certificates expiring in June 2026) and a legacy Agere Soft Modem Driver EoP — Microsoft removes agrsm64.sys and agrsm.sys entirely. Eight Critical vulnerabilities include 6 RCEs and 2 EoPs. Office gets an out-of-band RCE patch mid-month (CVE-2026-21509 — OLE bypass in all current Office versions). January is also notable: Microsoft has separately patched a Notepad RCE that could execute code via crafted Markdown links. The Notepad app is now an attack surface. Vault dwellers: this month has teeth. Patch promptly, but stage the rollout — there are significant known issues ahead. CVE-2025-62221 is the exploited one: a use-after-free in the Windows Cloud Files Mini Filter Driver (used by OneDrive, Google Drive, iCloud) that lets a local attacker escalate to SYSTEM. CISA added it to the KEV catalog with a December 30 remediation deadline. The two disclosed zero-days are CVE-2025-54100 — a PowerShell command injection that fires when Invoke-WebRequest parses a crafted web page (yes, just fetching a URL can execute code) — and CVE-2025-64671, a command injection in GitHub Copilot for JetBrains from the IDEsaster vulnerability class. December brings 1,275 CVEs patched for 2025 total — the second consecutive year over 1,000. Three Critical RCEs round out the severity list. Windows 11 KB5072033 and Windows 10 ESU KB5071546 are this month’s deployments. Stage your rollout carefully — commercial fleet admins should read the 72-hour column before deploying KB5074109 widely.
Desktop Window Manager (DWM) info disclosure — leaks memory section addresses from ALPC ports. Used to defeat ASLR and chain into privilege escalation. DWM is exploited regularly; this is the first wild zero-day. All Windows versions affected.
Secure Boot Certificate Expiration bypass — 2011-era certificates expire in June 2026. January begins rolling out replacements to targeted devices. If not updated, Secure Boot may break entirely, opening the door to bootkit attacks.
Microsoft Office OLE Security Feature Bypass — bypasses COM/OLE mitigations in Office 2016-2024 and M365 Apps. Exploited in the wild post-patch-day. Microsoft issued a service-side OOB fix January 23; restart Office to apply.
Windows Notepad RCE via crafted Markdown links — attacker tricks user into clicking a Markdown link in Notepad which executes local or remote programs without Windows security warnings. The humble text editor joins the attack surface.
58 Elevation of Privilege vulnerabilities in this month’s release — 50% of the total. January’s EoP concentration is the highest this year. Attackers love pivoting: initial access + EoP = SYSTEM. Prioritize Windows core components.
Sources: BleepingComputer · The Hacker News · Tenable
January 2026 is going to be remembered as one of the messier Patch Tuesdays in recent memory. KB5074109 immediately started causing problems: some commercial PCs stopped booting entirely with UNMOUNTABLE_BOOT_VOLUME (0xED) errors after install. For systems that did boot: Outlook froze and became unusable (Microsoft issued emergency OOB fix KB5078127 on January 24 just for Outlook). The shutdown/hibernate/sleep service produced restart-instead-of-shutdown behavior on Windows 11 23H2 Enterprise systems with Secure Launch enabled (OOB fix KB5077797 released January 17). Azure Virtual Desktop and Windows 365 credential prompts broke, blocking remote workers. Nvidia GPU users saw artifacts and frame rate drops in games like Forza Horizon. Nvidia investigated but the root cause was KB5074109. in enterprise IT circles for a long time. Within days of deploying KB5071546 (Windows 10 ESU/22H2), KB5071544 (Server 2019), and KB5071543 (Server 2016), MSMQ completely stopped working on affected systems. The security hardening for CVE-2025-62455 changed NTFS permissions on C:\Windows\System32\MSMQ\storage, stripping write access from non-admin service identities — IIS app pools, LocalService, NetworkService. The result: inactive queues, misleading “Insufficient disk space or memory” errors (when there’s plenty), IIS sites throwing HTTP 500s, and entire order-processing pipelines going dark. Microsoft confirmed the issue and initially directed all affected organizations to open a business support ticket for workaround guidance rather than publishing a public fix. than October’s dev catastrophe — but not silent. The most-reported issue: KB5068861 is causing laptops to freeze when waking from sleep, observed across Intel x64, AMD x64, and Qualcomm Snapdragon X (ARM64) devices. Multiple IT admins managing large fleets paused deployment across all tenants. ASUS ROG Ally X gamers hit install failures with errors 0x80071ab0 and 0x800f0991. Otherwise the update is clean — no major developer regressions, no localhost apocalypses., developers across Windows 11 24H2 and 25H2 discovered that localhost (127.0.0.1) was completely broken. Browser connections returned ERR_HTTP2_PROTOCOL_ERROR or ERR_CONNECTION_RESET. Visual Studio couldn't attach to IIS Express. The Duo Desktop authentication app stopped working. Autodesk Vault users couldn't connect to local servers. Root cause: a regression in HTTP.sys (the kernel-mode HTTP driver) that terminates HTTP/2 sessions on the loopback interface during handshake. A secondary regression broke WinRE — keyboards and mice stopped working in the Windows Recovery Environment, meaning if you needed to recover a broken PC, your input devices wouldn't work. Microsoft acknowledged the HTTP.sys issue on October 17 and deployed a Known Issue Rollback (KIR). Registry workaround: add EnableHttp2Tls and EnableHttp2Cleartext = 0 under HKLM\System\CurrentControlSet\Services\HTTP\Parameters.
- Windows 11 Commercial KB5074109 boot failures — UNMOUNTABLE_BOOT_VOLUME (0xED) on commercial PCs. Recovery via WinRE uninstall. Microsoft confirmed but provided no count of affected systems — inactive queues, IIS HTTP 500s, “Insufficient resources” errors. ACL change on MSMQ storage folder removes write access for service accounts — Intel, AMD, Snapdragon X affected. Fleet admins pausing deployment across tenants HTTP/2
- Windows 11 23H2 Enterprise Restart-instead-of-shutdown with Secure Launch enabled — OOB KB5077797 released Jan 17
- Windows 11 (all) Outlook frozen/unresponsive after update — OOB KB5078127 released Jan 24
- Windows 11 / Azure VD Azure Virtual Desktop and Windows 365 credential prompts broken — remote workers blocked
- Windows 11 (gaming) Nvidia GPU artifacts and FPS drops in games — Nvidia investigating, root cause is KB5074109
Sources: Windows Latest · BleepingComputer · r/sysadmin
Two OOB updates released but boot failures remain unresolved as of late January. KB5077797 (Jan 17) fixed the restart-instead-of-shutdown bug for Secure Launch devices. KB5078127 (Jan 24) fixed Outlook. Neither fixed the UNMOUNTABLE_BOOT_VOLUME boot failures on commercial PCs — those require WinRE recovery and manual KB5074109 uninstall. Microsoft applied safeguard holds to block the update from rolling out to known-vulnerable commercial configurations. The Office zero-day (CVE-2026-21509) was exploited post-Patch-Tuesday and patched via a service-side OOB update January 23 — restart Office apps to apply. on December 19 to restore MSMQ functionality — available via the Microsoft Update Catalog for manual import into WSUS/SCCM. The fix corrects the NTFS DACL on the MSMQ storage folder. If you’ve already applied the December LCUs, install the OOB update. If you’re not yet patched, Microsoft says the January cumulative will include the correct MSMQ behavior. The PowerShell Invoke-WebRequest issue has a mitigation: add -UseBasicParsing to all automated scripts that fetch web content. Review and audit any scheduled tasks or automation that calls Invoke-WebRequest. Sleep/wake freeze reports settled — the issue was limited to specific hardware configurations, not widespread enough for Microsoft to issue a formal known issue acknowledgement. No OOB updates were needed. The PoC for CVE-2025-62215 published November 20 generated attention but no new confirmed exploitation beyond the original zero-day usage. to consumer devices via Windows Update silently — many users found it fixed on reboot without a manual update. Enterprise admins needed to deploy a specific Group Policy KIR package. The WSUS RCE (CVE-2025-59287) was confirmed exploited in the wild by October 24, Microsoft issued an out-of-band update with a more comprehensive fix. WinRE keyboard/mouse fix arrived via a separate OOB update (KB5070773). Windows 10 end-of-support left a long tail: organizations discovering devices not enrolled in ESU, facing a hard choice between paying Microsoft for extended support or facing zero future patches.
- Windows 11 Commercial Boot failures — still unresolved by late January. Manual recovery via WinRE. Microsoft applied safeguard holds. Fix expected in February PT Install via Update Catalog or wait for January cumulative
- Windows 11 (all) Outlook freeze resolved — OOB KB5078127, Jan 24
- Windows 11 (all) Restart/shutdown bug resolved — OOB KB5077797, Jan 17
- Microsoft Office CVE-2026-21509 OLE bypass patched Jan 23 service-side — restart Office apps to apply
Sources: Windows Central · BleepingComputer: Office OOB · AskWoody
Resources