According to information from the Information Technology and Digital Transformation Center (Vietnam Social Security), Microsoft has just warned about 114 highly and seriously affected security vulnerabilities that exist in its products in January 2026.
These vulnerabilities can be exploited, causing unsafety for information systems that use Microsoft products, especially the Windows operating system.
The most notable point of this update is that Microsoft confirmed that there are up to three unknown vulnerabilities that have been patched, of which at least one vulnerability has been exploited in practice. This makes the January 2026 patch a top priority for security and system administrator teams.
Immediately after receiving the warning, Vietnam Social Security checked, reviewed, and identified servers and workstations using operating systems that may be affected by the above security vulnerabilities. For affected cases, patch updates are applied to the vulnerabilities according to Microsoft's instructions.
In addition, Vietnam Social Security also strengthens supervision and is ready with handling plans when detecting signs of being exploited and cyberattacked; and regularly monitors the warning channels of functional agencies and large organizations on information security to promptly detect cyberattack risks.
According to Microsoft statistics, 114 patched vulnerabilities include 57 privileged escalation vulnerabilities, 22 remote code execution vulnerabilities, 22 information leakage vulnerabilities, 5 fake vulnerabilities, 3 vulnerabilities beyond security mechanisms and 2 service denial vulnerabilities. The overall picture shows that the attack surface is still strongly focused on privileged mechanisms and memory processing.
The most dangerous vulnerability in this release is CVE-2026-20805, an information leak that does not require authentication to exploit the vulnerability. Although it does not directly allow system control, memory information leakage can become an important link in more complex exploitation chains.
This vulnerability has been included by the US Network and Infrastructure Security Agency in the list of exploited vulnerabilities, and organizations are required to complete the patch before February 3, 2026.
More worrying for the business environment is the CVE-2026-20854 vulnerability in local security services. This is a component that plays a central role in the authentication and login information management mechanism.
According to Microsoft, an attacker already has legitimate rights that can be exploited to remotely enforce code over the network, creating serious risks to internal systems and infrastructure.
With the actual vulnerability being exploited, Microsoft recommends that organizations test and deploy patches in January 2026. In the context of increasingly sophisticated attack chains and thoroughly exploiting unknown vulnerabilities, this warning is not only a periodic update but also a defense work that needs to be implemented as soon as possible.
These highly and serious security vulnerabilities can be exploited by attackers to carry out illegal acts, causing risks of information insecurity and affecting the information systems of agencies, organizations and businesses.
