Microsoft Patch Tuesday Fixes 149 Flaws Including Two Exploited Zero-Days
Active Exploitation · 2 sources · Updated 4mo ago · First seen Jan 25, 2026
Microsoft released security updates addressing 149 vulnerabilities across Windows and other products, including 67 remote code execution flaws, 3 critical issues, and two zero-days that were already being exploited in the wild. The actively exploited bugs were tracked as CVE-2024-29988, a Windows SmartScreen security feature bypass with a CVSS 8.8, and CVE-2024-26234, a spoofing vulnerability with a CVSS 6.7.
Reports said Water Hydra abused CVE-2024-29988 to deliver malicious files, while CVE-2024-26234 was identified during analysis of a malicious proxy driver operating as a backdoor and signed with a valid Microsoft Windows Hardware Compatibility Publisher certificate. Microsoft published the fixes as part of its March/April 2024 security release materials, and defenders were urged to deploy the updates quickly across affected Microsoft environments.
