Windows 11 January 2026 update: KB5074109 fixes battery drain and 114 security flaws

A day after Microsoft’s first Patch Tuesday of 2026, the picture is clearer: the company’s latest Windows updates fix 114 security flaws, including three zero-day vulnerabilities, and so far the rollout looks relatively smooth for most Windows 11 users.

Three zero-days and a pile of privilege-escalation bugs

The January 2026 Patch Tuesday bundle addresses 114 CVEs across Windows, Office, SQL Server, Azure components, and other products, with eight vulnerabilities rated Critical and dozens more marked Important. A big chunk of the list is made up of elevation-of-privilege issues in core Windows services and drivers, plus multiple remote-code-execution bugs in Office and SharePoint.

Microsoft flags three zero-day vulnerabilities this month:

An information disclosure flaw in Desktop Window Manager (CVE-2026-20805) that can leak sensitive memory contents and be chained with other bugs to make exploits more reliable.

A Secure Boot certificate issue, where older UEFI certificates would begin expiring in mid-2026; the January updates refresh these certificates so systems keep booting securely.

Long-running vulnerabilities in legacy Agere Soft Modem drivers (CVE-2023-31096 and related issues), which Microsoft has now tackled by removing the affected drivers (agrsm64.sys, agrsm.sys and related files) from supported Windows builds entirely. Hardware that still relies on these old modems will stop working after the update.

What’s in KB5074109 for Windows 11

For Windows 11, the Patch Tuesday security fixes arrive as cumulative update KB5074109 (for 24H2/25H2) and KB5073455 (for 23H2). Once installed, systems move to Build 26200.7623 on 25H2 and 26100.7623 on 24H2, while 23H2 is bumped to build 226x1.6050.

Beyond the security patches, KB5074109 includes several quality-of-life tweaks that matter for laptop and desktop users:

• Power & battery: Fixes an issue where NPU-equipped laptops could stay awake when idle, hurting battery life.
• Networking: Resolves broken mirrored networking in WSL and some RemoteApp failures in Azure Virtual Desktop that appeared after earlier updates.
• Secure Boot: Starts rolling out new Secure Boot certificates in a phased way, based on telemetry about successful updates, to avoid bricking systems while the old certificates expire.
• WinSqlite3.dll: Updates a core Windows component that some security tools had been flagging as vulnerable.

Early issues: mostly minor so far

As of the day after release, Microsoft is not aware of any new widespread problems with the January updates. The only acknowledged quirk so far is a cosmetic bug that can hide the “show password” eye icon next to password fields on some systems, making it harder to check what you’ve typed but not breaking logins themselves.

With one zero-day already exploited in the wild and Secure Boot certificates on a fixed expiry path, the risk of skipping this patch cycle is likely higher than installing it—especially for machines that spend a lot of time online.