Microsoft Patches Critical Vulnerabilities, Including Actively Exploited Zero-Day

Microsoft has released security updates addressing 113 vulnerabilities across its Windows operating systems and related software. Among these, eight are classified as “critical,” and the company confirms that one zero-day flaw – CVE-2026-20805 – is already being exploited in the wild.

CVE-2026-20805: Information Disclosure in Desktop Window Manager

The actively exploited vulnerability, CVE-2026-20805, resides in the Desktop Window Manager (DWM), a core component of Windows responsible for managing and rendering the desktop interface. This flaw allows an authenticated local attacker to disclose sensitive information from the affected system. While assigned a CVSS score of 5.5 (Medium severity), its active exploitation elevates the risk.

According to Kevin Breen, senior director of cyber threat research at Immersive, CVE-2026-20805 can be used to undermine Address Space Layout Randomization (ASLR), a key security feature designed to prevent memory-manipulation exploits. By revealing memory locations, the vulnerability can be chained with other flaws to create a more reliable attack path. Microsoft Security Response Center

Chris Goettl, vice president of product management at Ivanti, emphasizes that the vulnerability affects all supported Windows versions and should not be underestimated based on its initial severity rating. A risk-based approach suggests prioritizing patching this vulnerability.

Additional Critical Vulnerabilities

Beyond the zero-day, Microsoft addressed two critical remote code execution vulnerabilities (CVE-2026-20952 and CVE-2026-20953) in Microsoft Office. These vulnerabilities can be triggered simply by previewing a malicious message.

The company also removed several modem drivers (agrsm64.sys and agrsm.sys) due to known vulnerabilities (CVE-2023-31096) that could allow privilege escalation. This follows a similar removal of a modem driver in October 2025 after discovering it was being exploited. NVD

Secure Boot Vulnerability and Certificate Expiration

A critical Security Feature Bypass vulnerability (CVE-2026-21265) affecting Windows Secure Boot was also patched. Secure Boot relies on certificates that are set to expire in June and October 2026. Systems without updated 2023 certificates will no longer receive Secure Boot security updates once the older certificates expire. Updating the bootloader and BIOS requires careful preparation to avoid rendering the system unbootable.

Other Updates

Mozilla released updates for Firefox and Firefox ESR, resolving 34 vulnerabilities, two of which (CVE-2026-0891 and CVE-2026-0892) are suspected to be actively exploited. Updates for Google Chrome and Microsoft Edge are also expected to address a high-severity vulnerability in Chrome WebView (CVE-2026-0628). SentinelOne

Administrators are advised to consult resources like the SANS Internet Storm Center and askwoody.com for detailed patch breakdowns and potential compatibility issues.