Microsoft Office Security Feature Bypass Vulnerability
Microsoft Office · KB5002713
Patch Tuesday
Patch Tuesday January 2026 – known issues, zero-days and what to do
On 13 Jan 2026 Microsoft fixed 124 vulnerabilities – critical: 17, already exploited (zero-days): 2. Known issues with the updates: none known.
124vulnerabilities
17critical
2zero-days
0known issues
What to do now
- Zero-days first: 2 vulnerabilities are already being exploited (CVE-2026-21509, CVE-2026-20805) – install the updates as soon as possible, starting with servers and exposed systems.
- 17 critical vulnerabilities (mainly Windows, Microsoft Office, Azure) – roll out promptly after a short test.
- No issues are known so far with the updates of this month – test and roll out as usual.
Zero-days: already exploited
Desktop Window Manager Information Disclosure Vulnerability
Windows, Windows ESU (Extended Security Updates) · KB5073723 KB5073457 KB5073724 KB5073379
Critical vulnerabilities (17)
Azure Resource Manager Elevation of Privilege Vulnerability
Azure
Azure Front Door Elevation of Privilege Vulnerability
Azure
Microsoft Account Spoofing Vulnerability
Azure
Azure Entra ID Elevation of Privilege Vulnerability
Azure
M365 Copilot Information Disclosure Vulnerability
Apps
Microsoft Word Remote Code Execution Vulnerability
Microsoft Office
Show 11 more critical vulnerabilities
Microsoft Office Remote Code Execution Vulnerability
Microsoft Office · KB5002826
Microsoft Office Remote Code Execution Vulnerability
Microsoft Office · KB5002826
Azure Logic Apps Elevation of Privilege Vulnerability
Azure
Windows Graphics Component Elevation of Privilege Vulnerability
Windows, Windows ESU (Extended Security Updates) · KB5073723 KB5073457 KB5073724 KB5073379
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office · KB5002824
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office · KB5002824 KB5002831
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
Windows · KB5073379 KB5074109
Copilot Studio Information Disclosure Vulnerability
Microsoft Office
Word Copilot Information Disclosure Vulnerability
Apps
Azure Data Explorer Information Disclosure Vulnerability
Azure
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Windows · KB5073379 KB5074109 KB5073455 KB5073450
Updates (KB) of this month
KB numbers according to the Security Update Guide; known issues from our update issues – click a KB to see all its entries.
| Update | Product family | Vulnerabilities | Known issues |
|---|---|---|---|
| KB5073379 | Windows | 83 | none known |
| KB5074109 | Windows | 83 | none known |
| KB5073455 | Windows | 76 | none known |
| KB5073457 | Windows | 74 | none known |
| KB5073723 | Windows | 70 | none known |
| KB5073724 | Windows | 70 | none known |
| KB5073450 | Windows | 15 | none known |
| KB5002825 | Microsoft Office | 7 | none known |
| KB5002828 | Microsoft Office | 7 | none known |
| KB5073722 | Windows | 6 | none known |
| KB5002822 | Microsoft Office | 6 | none known |
| KB5002826 | Microsoft Office | 3 | none known |
Show 11 more updates
| Update | Product family | Vulnerabilities | Known issues |
|---|---|---|---|
| KB5002824 | Microsoft Office | 3 | none known |
| KB5002831 | Microsoft Office | 3 | none known |
| KB5073697 | Windows | 3 | none known |
| KB5002827 | Microsoft Office | 2 | none known |
| KB5002823 | Microsoft Office | 2 | none known |
| KB5073031 | SQL Server | 1 | none known |
| KB5073177 | SQL Server | 1 | none known |
| KB5072936 | SQL Server | 1 | none known |
| KB5073700 | Windows | 1 | none known |
| KB5002829 | Microsoft Office | 1 | none known |
| KB5002713 | Microsoft Office | 1 | none known |
Known issues with the updates
No issues are known so far with the updates of this month.
By product family
More about this month
Where the information comes from
Fixed vulnerabilities, severity, zero-days and KB numbers come from the official Microsoft Security Update Guide (MSRC); known issues, workarounds and dated changes from our update issues, each with its source. “What to do now” is derived from this data using fixed rules, without AI.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.