on January 13, 2026 at 8:00 am — CVE-2026-0386 Windows Deployment Services Remote Code Execution Vulnerability
Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.
on January 13, 2026 at 8:00 am — CVE-2026-20803 Microsoft SQL Server Elevation of Privilege Vulnerability
Missing authentication for critical function in SQL Server allows an authorized attacker to elevate privileges over a network.
on January 13, 2026 at 8:00 am — CVE-2026-20965 Windows Admin Center Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Windows Admin Center allows an authorized attacker to elevate privileges locally.
on January 13, 2026 at 8:00 am — CVE-2026-20962 Dynamic Root of Trust for Measurement (DRTM) Information Disclosure Vulnerability
Use of uninitialized resource in Dynamic Root of Trust for Measurement (DRTM) allows an authorized attacker to disclose information locally.
on January 13, 2026 at 8:00 am — CVE-2026-21265 Secure Boot Certificate Expiration Security Feature Bypass Vulnerability
Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to Windows boot manager or Secure Boot. The operating system’s certificate update protection mechanism
on January 9, 2026 at 8:00 am — Chromium: CVE-2026-0628 Insufficient policy enforcement in WebView tag
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2024 ) for more information.