Patch Tuesday prioritisation still favours exploited Windows flaws

At a glance

What this is: This is Expel’s January 2026 Patch Tuesday analysis, which prioritises the most security-relevant Windows vulnerabilities and argues that exploitation evidence should drive patching order.

Why it matters: It matters to IAM and security teams because initial footholds, authenticated exploitation, and privilege escalation frequently become the entry point for identity abuse, service compromise, and broader lateral movement.

By the numbers:

• January’s Patch Tuesday includes 112 CVEs, including one zero-day vulnerability that is actively being exploited in the wild.
• In 2025, Expel recommended expedited patching of 46 CVEs with strong exploitation risk factors.
• 63% of the vulnerabilities Expel prioritised in 2025 showed evidence of exploitation in the wild.
• 39% of those prioritised vulnerabilities were identified in the CISA KEV catalog.

👉 Read Expel’s January Patch Tuesday analysis and 2025 exploit-retrospective

Context

Patch Tuesday triage is no longer just a vulnerability management exercise. In environments where attackers turn one foothold into credential access, privilege escalation, or control-plane abuse, patch priority becomes a governance decision about which exposures most likely change the attacker’s access path first. The January 2026 release is a good example of that shift because the most relevant question is not how many CVEs exist, but which ones can become operational access.

Expel’s analysis sits in the middle of the vulnerability management workflow, but the identity angle is real. A foothold on a Windows system, an authenticated SharePoint session, or access to Azure Arc can become a bridge into secrets, service accounts, and elevated permissions. That makes exploitability, not just CVSS, the better signal for teams that manage human identity, NHI, and privileged access together.

The pattern described here is typical for modern enterprise patch prioritisation: attackers prefer flaws that provide memory disclosure, remote code execution, or elevation of privilege because those defects shorten the route to durable access.

Key questions

Q: What breaks when a vulnerability becomes an identity problem as well as a patching problem?

A: Patching only removes the code flaw. If the exploit chain already exposes credentials, trusted update paths, or elevated access, the organisation still has an identity exposure that can be abused before or during remediation. Teams should therefore link exploit intelligence to IAM and PAM controls so a vulnerable system does not become a durable access path.

Q: Why should organisations prioritise exploited vulnerabilities over higher-scoring but unexploited ones?

A: Because exploit evidence shows attacker relevance, not just technical possibility. A moderate-scoring flaw in CISA KEV or one already weaponised can create real intrusion risk immediately, while a higher-scoring issue with no exploitation may remain theoretical for longer. Prioritisation should follow adversary behaviour, not score order alone.

Q: How can teams tell when a vulnerability is likely to enable privilege escalation?

A: Look for flaws that expose memory layout, require authenticated access, allow remote code execution, or sit near administrative trust paths such as update services and management planes. Those conditions often indicate that a low-level defect can become SYSTEM-level access or broader lateral movement if exploited.

Q: Who is accountable when a vulnerability report misses an exploitable issue?

A: Accountability sits with the programme owner who accepted the testing model and closure criteria, not only with the tester. If the organisation chose snapshots over continuous validation, the control gap is governance-led. Security leaders, application owners, and risk owners all need clear closure standards and evidence requirements.

Technical breakdown

Why memory disclosure often precedes reliable exploitation

Information disclosure flaws can be more valuable than their scores suggest because they expose layout, pointers, or session artefacts that make later exploitation easier. In the January patch set, the Desktop Window Manager issue is described as a foothold-stage enabler that helps attackers bypass ASLR and line up a second-stage exploit. That matters because a low CVSS score can still sit inside a high-impact chain when it materially reduces exploitation uncertainty.

Practical implication: prioritise disclosure flaws that support follow-on exploitation even when their score looks moderate.

Authenticated RCE and why valid access changes the risk model

Several flaws in the roundup require authentication or a trusted network position, which is a reminder that attacker access does not always begin with unauthenticated internet exposure. If an adversary can use legitimate credentials, trick a user into connecting to a malicious server, or sit between update endpoints, the vulnerability becomes a privilege boundary failure rather than a classic perimeter breach. That makes identity assurance, segmentation, and trust validation part of patch triage.

Practical implication: rank authenticated exploits higher when they can turn valid access into code execution or control-plane reach.

Why exploit evidence should outweigh theoretical severity

Expel’s 2025 retrospective shows why exploit telemetry is such a strong prioritisation signal. CVSS describes technical severity, but exploitation evidence tells you whether an issue is already part of active attacker tradecraft. CISA KEV inclusion, malware weaponisation, and public exploitation all indicate that a flaw has crossed from potential to operational risk, which is what defenders actually need to manage.

Practical implication: use KEV, weaponisation, and in-the-wild evidence as faster ranking inputs than base severity alone.

Threat narrative

Attacker objective: The attacker’s objective is to turn a single exploitable weakness into durable execution, elevated privilege, and a wider route into enterprise systems.

1. Entry occurs when attackers gain a foothold through an exploited Windows flaw, a legitimate authenticated session, or position themselves in a trusted update path.
2. Escalation follows when disclosure, RCE, or buffer overflow conditions let them bypass memory protections, execute code, or gain SYSTEM-level privileges.
3. Impact is achieved when the new access enables privilege escalation, control of update mechanisms, or broader reach into enterprise systems and identities.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exploitability is the real prioritisation model, not raw vulnerability counts. Patch Tuesday volume matters, but the governance question is which flaws create a usable attacker path first. CVSS alone cannot tell teams whether an issue already sits inside an active intrusion pattern. Practitioners should therefore treat KEV-listed and weaponised flaws as operational access risks, not just remediation queue items.

Identity and vulnerability management now overlap at the foothold stage. Several flaws in this roundup become dangerous only after a user authenticates, a server trusts an update source, or an attacker lands on an already-compromised host. That is where privilege and trust assumptions collapse, and why IAM, PAM, and endpoint teams need a shared view of exploitation risk. The control problem is not only patch speed, but preventing a foothold from becoming identity abuse.

Attackers prefer flaws that shorten the route to elevated access. Information disclosure, authenticated RCE, and privilege escalation are not separate silos in practice. They often form a chain that moves from discovery to execution to durable control, which is why defenders should look at vulnerability portfolios as access-path portfolios. Teams should prioritise the flaws that most directly expand attacker reach across identity and system boundaries.

KEV and weaponisation data should shape board-level patch policy. The retrospective numbers show that most high-confidence exploitation decisions were justified after the fact. That means the governance challenge is not whether a vulnerability is theoretically dangerous, but whether the organisation has a repeatable way to elevate known exploited issues ahead of routine maintenance windows. Practitioners need policy-driven thresholds that tie exploitation evidence to remediation deadlines.

Control-plane adjacent assets deserve special scrutiny. WSUS, SharePoint, Azure Arc, and RRAS are not just application targets. They sit close to trust distribution, remote administration, and privileged connectivity, which makes them more valuable than ordinary endpoints once an attacker is inside. Security teams should treat these systems as high-leverage infrastructure and align patch urgency with the access they can confer.

From our research:

• 63% of the vulnerabilities Expel prioritised in 2025 showed evidence of exploitation in the wild, according to the Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• Forward pivot: NHI Lifecycle Management Guide shows how lifecycle controls reduce the time attackers can turn a foothold into reusable access.

What this signals

Patch governance is becoming a broader access-control problem because exploited systems are often the same systems that expose administrative trust, update pathways, and service credentials. Teams that separate patching from identity governance will miss the moment when a defect becomes an access path. The practical response is to tie exploit telemetry to privileged access review, service account scrutiny, and containment priorities.

Exploit-path governance: this is the point at which vulnerability management stops being a list of CVEs and becomes a decision model for which attack paths can still reach privileged systems. That model should be informed by NIST Cybersecurity Framework 2.0 and, where identities are involved, by lifecycle controls that shorten exposure windows.

For programmes that already track secrets, service accounts, and admin sessions, the lesson is to treat exploited infrastructure as a potential identity bridge, not just an endpoint issue. When a foothold sits near authentication, update trust, or remote management, the risk of credential abuse rises sharply and containment must happen before normal remediation cycles complete.

For practitioners

• Prioritise KEV-listed and weaponised flaws first Build patch queues around CISA KEV, malware weaponisation, and public exploitation before CVSS-based bulk remediation. That is the fastest way to reduce the number of vulnerabilities that already match active attacker tradecraft.
• Treat authenticated exploits as identity risks Flag vulnerabilities that require valid credentials, trusted connections, or user interaction because they can turn ordinary access into privileged execution. That review should include domain-authenticated services, admin tools, and update channels.
• Separate control-plane assets into a faster patch lane Put SharePoint, WSUS, Azure Arc, RRAS, and similar trust-distribution systems into an accelerated remediation path with tighter change windows and compensating controls. These systems can amplify attacker reach far beyond a single host.
• Use exploit evidence in access governance reviews Feed exploitation status into IAM and PAM risk discussions so teams know when a system compromise could become credential abuse or privilege escalation. That is especially important where service accounts, admin sessions, or update trust are involved.

Key takeaways

• Patch Tuesday prioritisation works best when exploitation evidence, not CVSS alone, drives the queue.
• The highest-risk flaws often matter because they create an access path, not just a software defect.
• Teams should connect vulnerability response to IAM and PAM governance whenever trusted systems can become attacker footholds.

Key terms

• Exploitability-first prioritisation: A vulnerability triage approach that ranks findings by the likelihood of real-world abuse rather than by severity score alone. It uses signals such as active exploitation, exposure, asset criticality and privilege context to decide what should be fixed first when analysis capacity is constrained.
• Known Exploited Vulnerability: A Known Exploited Vulnerability is a flaw that has confirmed active exploitation in the wild and is tracked for urgent remediation. In governance terms, KEV status turns patching from a general hygiene task into a time-bound operational obligation.
• Control-plane asset: A system that distributes trust, administration, or update authority across the environment. Examples include patching infrastructure, identity services, management consoles, and remote administration tools. Compromise of these assets can expand attacker reach far beyond the initial host.
• Authenticated exploitation: An attack pattern where the adversary needs a valid session, trusted connection, or legitimate credentials to trigger the flaw. This often shifts the risk from perimeter breach to identity misuse, because the attacker is leveraging existing trust to reach code execution or elevated access.

What's in the full article

Expel's full blog post covers the operational detail this post intentionally leaves for the source:

• Month-by-month vulnerability tables with EPSS, KEV status, and exploit-evidence annotations for the 2025 predictions list
• The full prioritisation rationale behind each CVE selection, including why some lower-scoring flaws were still escalated
• A complete breakdown of the January 2026 Patch Tuesday items, including the specific exploitation conditions for each CVE
• The retrospective comparison between prediction accuracy, in-the-wild exploitation, and ransomware or malware weaponisation

👉 Expel’s full post includes the CVE-by-CVE prioritisation table and exploitation evidence behind each call.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, machine identity security, and secrets management. It helps practitioners connect access-risk decisions to the broader security programme they run.