January 2026 Third-Party Vulnerabilities and Patches 

January picked up again after December’s slowdown. We logged 96 unique vulnerabilities across 61 applications, and remediation work drove more than a thousand version updates. Activity was clearly higher than in the previous month, with both findings and patches trending upward. 

Notable vulnerabilities in January 2026 third-party patches 

I have good news. There are no vulnerabilities with known exploits and none of the vulnerabilities have an elevated EPSS rating. This month we will focus on vulnerabilities with the highest CVSS rating. 

First, CVE‑2025‑15467 is a critical OpenSSL vulnerability involving a stack buffer overflow when processing CMS AuthEnvelopedData messages. An attacker can trigger the overflow before authentication or tag verification occurs, meaning the issue can be exploited without valid key material. The impact ranges from denial of service to possible remote code execution, depending on compilation hardening. The vulnerability affects OpenSSL versions across several major Linux distributions and vendor builds. With a CVSS score of 9.8, this should be treated as a high‑priority patch for any environment using OpenSSL 3.x. In the Setup Store application catalog, it affects OpenSSL by Shining Light Productions. More information about this vulnerability can be found in OpenSSL’s Security Advisory. The following versions will patch the vulnerability: 

• OpenSSL 3.4.4 
• OpenSSL Light 3.4.4 

CVE–2025–66471 is a vulnerability in the Python urllib3 library tied to how compressed data is decompressed. A malicious server can get excessive CPU and memory usage, creating a denial‑of‑service condition. It affects urllib3 versions 1.0 through 2.5.0 and impacts a wide range of Linux distributions and cloud‑native ecosystems that embed urllib3 by default. With a CVSS score of 8.9, organizations should update to urllib3 2.6.0 or vendor‑provided patched builds. Full details can be found in the urllib3 release documentation and distribution advisories. It affects Microsoft Azure CLI, and it is patched in version 2.82.0. 

A related issue, CVE–2025–66418, also impacts urllib3 and allows a malicious server to create an effectively unbounded decompression chain, leading to resource exhaustion. Like the previous vulnerability, this affects a broad set of Python‑based systems, including those embedded in orchestrators, automation tools, and cloud workflows. CVSS is 8.9, and the recommended remediation is the same: upgrade to urllib3 2.6.0. Additional information is available through urllib3 maintainers and security bulletins. The vulnerability also affects Microsoft Azure CLI.  

CVE–2026–0885 is a use‑after‑free vulnerability in Mozilla Firefox and Thunderbird’s JavaScript garbage collector. A crafted webpage can trigger arbitrary code execution or denial of service. Affected versions include Firefox before 147, ESR before 140.7, and Thunderbird before the same thresholds. With a CVSS score of 8.8, this warrants timely patching, particularly for organizations with high browser exposure. More details can be found in Mozilla’s security advisories and release notes.  

Browser security updates in January 2026 

Major browsers, including Google Chrome, Microsoft Edge, Brave, Mozilla Firefox (including ESR versions), Opera One, Vivaldi, and others received numerous security updates addressing various vulnerabilities.  

Microsoft product updates included in January 2026 third-party patches 

In addition to Edge, Microsoft issued security updates for several other products: 

Detailed list of January 2026 third-party patches 

For a complete list of applications, versions, and the number of remediated vulnerabilities, see the table below generated using Application Workspace data. 

Application management at the speed of your operations 

Vulnerabilities move fast, especially in a distributed workforce. Discover how Recast’s application management product, Application Workspace, helps IT teams keep applications patched, compliant, and correctly configured, wherever work happens.