Overview
- Microsoft’s January security release patches an actively exploited flaw, CVE-2026-20805, in Desktop Window Manager that exposes ALPC memory on Windows 10, Windows 11, and multiple Server editions.
- Post‑update, Microsoft confirms the Windows app fails to authenticate for Azure Virtual Desktop and Windows 365 on several client and server builds; users should switch to the Remote Desktop client or the web client at windows.cloud.microsoft.
- Windows 11 23H2 devices using System Guard/Secure Launch can no longer shut down or sleep after KB5073455; Microsoft advises using the command shutdown /s /t 0 to power off and says no sleep workaround is available yet.
- The update removes legacy Agere and Motorola softmodem drivers to close long‑standing elevation‑of‑privilege issues tracked as CVE-2023-31096 and CVE-2024-55414.
- Microsoft highlights Secure Boot certificate renewal requirements tied to CVE-2026-21265, and Windows 10 ESU users receive KB5073724 with the security fixes and driver removals.