Technology giants Microsoft and Adobe started the year by releasing a significant volume of security updates, addressing dozens of vulnerabilities in their main products. The packages, released in the traditional “Patch Tuesday” in January, aim to protect users and companies against a growing range of digital threats that can compromise data and systems.
The urgency of the fixes is accentuated by the confirmation that one of the flaws detailed by Microsoft is already being actively exploited by cybercriminals. Este scenario raises the alert level for IT administrators, who need to act quickly to apply patches and mitigate risks associated with ongoing attacks.
The suite of updates ranges from creative and design software to operating systems and productivity applications, reflecting the complexity of the modern digital ecosystem. The coordinated action of companies highlights the importance of a proactive stance in maintaining global cybersecurity.
Details of fixes released by Adobe
Adobe presented 11 different security bulletins for the month of January, which, together, correct a total of 25 vulnerabilities identified by CVE codes. The list of affected software is extensive and includes popular tools such as Dreamweaver, InDesign, Illustrator, InCopy, Bridge, as well as the Substance 3D suite and the ColdFusion platform.
More on this story: Microsoft releases large update package with almost 400 security fixes for its systems
The update to ColdFusion was rated Prioridade 1, the highest, indicating an elevated risk despite there being no known exploits at the time of release. The fix addresses a single but serious code execution flaw. In contrast, most other updates were classified as priority 3, signaling less immediate urgency.
Dreamweaver, for example, had five critical code execution vulnerabilities patched, while InDesign also received patches for five flaws, four of which were considered critical. The Substance 3D suite, although it received multiple fixes, only had a few flaws classified as critical, such as those found in Stager and Painter.
Microsoft’s massive update package
Microsoft began the security calendar with the disclosure of 112 new vulnerabilities in its ecosystem, a number that rises to 114 when including third-party updates from Chromium to the Edge browser. Este Robust volume of patches is a common practice in January, often the result of postponing less urgent patches during the holiday season to avoid potential instability at a time of reduced teams.
Learn more: Microsoft releases urgent Windows update and fixes hundreds of actively exploited flaws
Among the 114 faults addressed, eight were classified as Críticas, the highest severity category, while the remaining 106 were considered Importantes. The vulnerabilities span a wide range of products and services, including the Windows operating system, the Office suite, the Azure cloud platform, SharePoint Server, SQL Server, and other vital components, demonstrating the ongoing challenge of securing such an interconnected and widely used software infrastructure.
A failure in active exploration that requires immediate attention
The most critical point of the Microsoft package is, without a doubt, the CVE-2026-20805 vulnerability, an information disclosure flaw in Gerenciador of Janelas of Área of Trabalho (Desktop Window Manager). The company confirmed that this loophole is already being exploited in real attacks, which makes it an absolute priority for patching.
While information disclosure flaws are not always seen as the most dangerous, this one in particular allows an attacker to obtain remote ALPC (Advanced Local Procedure Call) port section addresses. Essa information, apparently technical, is extremely valuable for an attacker.
With these addresses in hand, the cybercriminal can construct more complex and reliable attacks, often as an intermediate step in an exploitation chain that ultimately aims at remote code execution (RCE). Microsoft did not provide details on the scale of the attacks, but the nature of the flaw indicates a significant risk to systems that remain unprotected.
High risks in Microsoft Office and Secure Boot
The Microsoft Office suite continues to be a frequent target, and the January updates fix the remote code execution flaws CVE-2026-20952 and CVE-2026-20953. The danger of these vulnerabilities is amplified by the fact that they can be exploited through Painel,
On the same topic: Microsoft Amplifies Windows Updates Against AI-Driven Vulnerability Threats
While there are no known active exploits for these two specific flaws, the recurrence of issues in Painel and Visualização solidifies it as a high-risk attack vector. Como additional mitigation measure, security experts recommend that administrators disable this feature in environments where security is a top priority.
Another notable vulnerability is CVE-2026-21265, which affects the Secure Boot security feature. The flaw, caused by the expiration of a certificate, represents a security bypass. If left unfixed, it could prevent devices that rely on Secure Boot from installing future updates or trusting new bootloaders.
Although Microsoft assesses the probability of exploration as low, the potential for operational problems is high. The flaw could leave systems vulnerable to future attacks and significantly complicate the security management of affected devices in the long term.
Analysis of other critical vulnerabilities
In addition to the flaws already highlighted, the January Microsoft package addresses several other critical vulnerabilities that deserve attention. Entre are remote code execution holes in Microsoft Excel and Word, which have traditionally been entry vectors for malware. Também Fixed an elevation of privilege flaw in Serviço of Subsistema of Autoridade of Segurança Local (LSASS), a core component of Windows.
More on this story: Google launches Gemini 3.5 Flash Cyber, a lightweight AI model to strengthen global cybersecurity
A particularly technical and dangerous vulnerability is CVE-2026-20876, an elevation of privilege flaw in Enclave of Segurança Baseada in Virtualização (VBS) of Windows. Este modern security feature isolates critical system processes. The flaw allows an attacker to elevate their privileges to the highest level within this secure environment, representing a serious compromise of the operating system’s security architecture.
Recommended actions for IT teams
Given the number and severity of the vulnerabilities fixed, it is imperative that system administrators and information security teams prioritize the immediate application of the patches released by Microsoft and Adobe. The existence of a flaw under active attack increases urgency, turning the update into a race against time to protect the organization’s digital assets.
Patch implementation and testing
Best practices recommend that updates be tested in a controlled environment before being deployed across the entire production network. Essa step is crucial to check compatibility with existing systems and avoid unexpected service interruptions. Assessment of the impact of each CVE on the company’s specific environment should guide the implementation priority order, starting with the most exposed and critical systems.