Microsoft Patch Tuesday Fixes 172 Flaws, Including 6 Actively Exploited Bugs
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jan 5, 2026
Microsoft released security updates for 172 vulnerabilities across Windows, Office, Exchange, SharePoint, .NET, Visual Studio, PowerShell, and Windows Server, with 8 rated critical and 162 rated important. The company said 6 vulnerabilities were actively exploited in the wild, including Windows privilege-escalation flaws affecting the Agere Modem native driver and Windows Remote Access Connection Manager, while critical issues in the release included remote code execution and privilege-escalation risks.
The update set also referenced related security issues involving IGEL OS Secure Boot, AMD EPYC SEV-SNP, and the TCG TPM 2.0 specification, with Microsoft still working on mitigations for Azure Confidential Computing exposure tied to the AMD issue. Microsoft’s Security Update Guide included advisory CVE-2025-24990, and defenders were urged to deploy patches through standard Microsoft update channels and review product-specific guidance immediately.
