Microsoft Patch Tuesday January 2026: Critical RCE flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft releases critical patches for multiple products including Windows and Office; CVE-2026-20805 actively exploited in the wild.
On January 13, 2026, Microsoft released critical security patches addressing multiple remote code execution vulnerabilities across its product portfolio. The vulnerabilities affect a broad range of systems including Windows components (kernel, LSASS, HTTP.sys, SMB, Kerberos), Office applications, SQL Server, Azure services, and Windows Server Update Service among others. The most severe vulnerabilities could allow unauthenticated remote code execution, granting attackers the same privileges as the compromised user. Microsoft has confirmed that CVE-2026-20805 is actively being exploited in the wild. Successful exploitation could enable attackers to install malware, access or modify data, create privileged accounts, and establish persistence depending on the compromised user's privilege level. The advisory recommends immediate patching after testing, implementation of least-privilege principles, network segmentation, vulnerability scanning, and exploit protection features.
Mentioned in this report
Detection guidance
Office Application Spawning Command Shell or Script Interpreter
Detects Office applications spawning shells or script hosts, a common result of exploiting an Office RCE flaw for client execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Command Shell or Script Interpreter
id: ba7dd03b-ca40-5f8e-94ba-fa44ad0775e3
status: experimental
description: Detects Microsoft Office processes spawning command shells, script hosts
or LOLBins. This is typical post-exploitation behaviour after a client-side RCE
(for example an Office memory-corruption flaw) and generalises on the parent/child
relation, not on any specific CVE.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
- \MSPUB.EXE
- \VISIO.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \bitsadmin.exe
- \certutil.exe
condition: selection
falsepositives:
- Legitimate Office macros or add-ins that launch cmd.exe or PowerShell for business
automation
- Outlook rules or integrations that invoke scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-january-13-2026_2026-002
Public-Facing Server Process Spawning Shell or Recon Utility
Detects web, SQL and WSUS server processes spawning shells or LOLBins, indicating possible exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Public-Facing Server Process Spawning Shell or Recon Utility
id: 7815d942-fb34-5c72-97a6-ad122d1ecddb
status: experimental
description: Detects server-side processes (IIS worker, SQL Server, WSUS service,
Apache/nginx/Tomcat) spawning command interpreters or common post-exploitation utilities.
This pattern is expected after successful exploitation of an RCE in a public-facing
service.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \w3wp.exe
- \sqlservr.exe
- \WsusService.exe
- \httpd.exe
- \nginx.exe
- \tomcat8.exe
- \tomcat9.exe
- \tomcat10.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \net.exe
- \net1.exe
- \nltest.exe
condition: selection_parent and selection_child
falsepositives:
- SQL Server jobs or xp_cmdshell used by DBAs for maintenance
- Web applications that legitimately shell out to cmd.exe or PowerShell for administration
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-january-13-2026_2026-002
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-january-13-2026_2026-002
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs