# Microsoft Patch Tuesday January 2026: Critical RCE flaws

Published: 2026-01-13 · Severity: high · Sectors: government-national, financial-services, healthcare, technology
Canonical: https://vorant.io/reports/c26f92e7-fc21-55db-b0cd-6423f92ff3e8/microsoft-patch-tuesday-january-2026-critical-rce-flaws

> Microsoft releases critical patches for multiple products including Windows and Office; CVE-2026-20805 actively exploited in the wild.

On January 13, 2026, Microsoft released critical security patches addressing multiple remote code execution vulnerabilities across its product portfolio. The vulnerabilities affect a broad range of systems including Windows components (kernel, LSASS, HTTP.sys, SMB, Kerberos), Office applications, SQL Server, Azure services, and Windows Server Update Service among others. The most severe vulnerabilities could allow unauthenticated remote code execution, granting attackers the same privileges as the compromised user. Microsoft has confirmed that CVE-2026-20805 is actively being exploited in the wild. Successful exploitation could enable attackers to install malware, access or modify data, create privileged accounts, and establish persistence depending on the compromised user's privilege level. The advisory recommends immediate patching after testing, implementation of least-privilege principles, network segmentation, vulnerability scanning, and exploit protection features.

## Mentioned in this report

- Vulnerabilities: CVE-2026-20805 (KEV)

## Detection guidance (public sample)

### Office Application Spawning Command Shell or Script Interpreter

ATT&CK: T1203

Detects Office applications spawning shells or script hosts, a common result of exploiting an Office RCE flaw for client execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Command Shell or Script Interpreter
id: ba7dd03b-ca40-5f8e-94ba-fa44ad0775e3
status: experimental
description: Detects Microsoft Office processes spawning command shells, script hosts
  or LOLBins. This is typical post-exploitation behaviour after a client-side RCE
  (for example an Office memory-corruption flaw) and generalises on the parent/child
  relation, not on any specific CVE.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    - \MSPUB.EXE
    - \VISIO.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \bitsadmin.exe
    - \certutil.exe
  condition: selection
falsepositives:
- Legitimate Office macros or add-ins that launch cmd.exe or PowerShell for business
  automation
- Outlook rules or integrations that invoke scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-january-13-2026_2026-002
```

### Public-Facing Server Process Spawning Shell or Recon Utility

ATT&CK: T1190

Detects web, SQL and WSUS server processes spawning shells or LOLBins, indicating possible exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Public-Facing Server Process Spawning Shell or Recon Utility
id: 7815d942-fb34-5c72-97a6-ad122d1ecddb
status: experimental
description: Detects server-side processes (IIS worker, SQL Server, WSUS service,
  Apache/nginx/Tomcat) spawning command interpreters or common post-exploitation utilities.
  This pattern is expected after successful exploitation of an RCE in a public-facing
  service.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - \sqlservr.exe
    - \WsusService.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \tomcat10.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \nltest.exe
  condition: selection_parent and selection_child
falsepositives:
- SQL Server jobs or xp_cmdshell used by DBAs for maintenance
- Web applications that legitimately shell out to cmd.exe or PowerShell for administration
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-january-13-2026_2026-002
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-january-13-2026_2026-002

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c26f92e7-fc21-55db-b0cd-6423f92ff3e8/microsoft-patch-tuesday-january-2026-critical-rce-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup