Deploy Microsoft Windows security update KB5074109

This official Microsoft Patch Tuesday update addresses 83 linked CVEs for Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, plus 1 more. Microsoft reports exploitation for CVE-2026-20805.

Product: Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, plus 1 more
Release: 10.0.26100.7623, 10.0.26200.7623
Published: 2026-01-13
Updated: 2026-01-13
Cycle: January 2026 Patch Tuesday

Out-of-band actionBlackTree recommended timinghigh confidence

83Vendor-linked CVEsComplete For Update

1Preserved revisionsCanonical history remains visible

0Known issuesVendor-documented context only

Action and evidence

Operational decision

Action type: Deploy Patch
Platform: Windows
Restart: yes
Vendor signal: Critical

Why this urgency

Fix Available
Active Exploitation Confirmed

Evidence signals kept separate

CISA KEV: Unknown
Confirmed exploitation: Confirmed
Vendor exploitability: Microsoft reports exploitation
Maximum CVSS: 8.8 (CVSS 3.1, CVE-2026-20868)
Maximum EPSS: Not loaded for this patch record

Out-of-band action

BlackTree recommends an out-of-band change assessment. Do not wait for the normal patch window when this update applies, but still use tested deployment and rollback controls.

BlackTree urgency is an operational review window. It does not replace vendor severity or CVSS.

Environment override questions

Is Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, plus 1 more exposed to untrusted networks or content?
Does this update affect an identity, management, backup or other control-plane system?
Are compensating controls tested and monitored until the selected patch window?

Deployment context

Effects and caveats

Use the vendor update channel or update catalogue entry for the applicable product release.
Plan a restart when the vendor remediation marks one as required.

Known data gaps

Confirm exact product, edition and architecture applicability in the Microsoft Security Update Guide before deployment.

Deployment plan

Guidance basis: Blacktree Generic

Prerequisites

Confirm the affected product, edition, architecture and current build before deployment.

Sequencing

Test the update in a representative deployment ring before broad release.

Downtime

A restart is required. Plan service interruption and validation.

Rollback and recovery

Capture the current version and a recoverable backup or snapshot before the change.
Use the vendor-supported uninstall or recovery path when one is available.

Workarounds

No vendor workaround is asserted unless it appears in the official advisory.

Vulnerability relationships

Vendor-linked CVEs

The complete CVE relationship set is not available in this bounded record.

Linked CVEs: 83
Confirmed exploited: 1
PoC or lab evidence: 0
Maximum CVSS: 8.8

Open linked CVE review

Provenance

Field verification

Patch_identity_and_productsmsrc-cvrf/vendor-fixVerified Automatic · Retrieved 26 Aug 2026, 11:55 UTC
Cve_relationships_and_exploit_statusmsrc-cvrf/vulnerabilityVerified Automatic · Retrieved 26 Aug 2026, 11:55 UTC

Open official vendor source

Revision history

Canonical record changes

Revision 12026-01-13
Initial Patch Tuesday publication.

Publication review

The update identity, affected product mapping, restart signal, vendor severity, exploit status and complete CVE relationships were generated from the official MSRC CVRF document and passed structural validation. The project owner approved automatic Patch Tuesday publication. Each published record passed its own official-source completeness gate. Pending sources expose readiness only and prior approved records are retained on refresh failure.