January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day

January 2026 saw a surge in critical vulnerabilities—driven by Russian APT28’s active exploitation of a Microsoft Office zero-day and multiple authentication bypass flaws—highlighting the urgent need for enterprises to patch and monitor communication and management platforms against sophisticated state-sponsored and criminal threat actors.