HighCISA KEVExploited in the wildPublic exploit

Desktop Window Manager Type Confusion Local Privilege Escalation

IdentifiersCVE-2026-21519CWE-843· Access of Resource Using…

CVE-2026-21519 is an elevation of privilege vulnerability in Microsoft Windows Desktop Window Manager (DWM, including dwm.exe) caused by access of a resource using an incompatible type, i.e., a type confusion condition. The flaw is described by Microsoft and downstream reporting as affecting the Desktop Window Manager subsystem and allowing a local authorized attacker to elevate privileges. Available reporting indicates successful exploitation can result in execution with SYSTEM privileges. Publicly available source material does not provide function-level root cause details beyond the type confusion in DWM.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a local attacker with prior access to a vulnerable Windows system to escalate privileges from a lower-privileged context to SYSTEM. With SYSTEM-level execution, an attacker could fully compromise the host, disable or tamper with security tools, deploy additional malware, access protected credentials or data, and use the system as a stronger foothold for persistence or lateral movement. The vulnerability is reported as actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities catalog.

Mitigation

If you can’t patch tonight, do this now.

No specific vendor workaround or feature-level mitigation is provided in the supplied content. Until patching is complete, reduce exposure by limiting local attacker footholds, restricting interactive access, enforcing least privilege, monitoring for anomalous privilege-escalation behavior involving DWM/SYSTEM transitions, and increasing detection for post-exploitation actions such as security-tool tampering, malicious service changes, credential access, and suspicious local code execution. Prioritize rapid patch deployment on internet-exposed or high-value systems where an initial foothold is more likely.

Remediation

Patch, then assume compromise.

Apply Microsoft's February 2026 security updates for all affected Windows versions. The provided content maps CVE-2026-21519 to Microsoft updates for supported platforms, including Windows 11, Windows 10, and Windows Server releases. Organizations should prioritize this patch because exploitation in the wild has been reported and CISA added the CVE to KEV. Validate deployment across affected endpoints and servers and investigate potentially exposed systems for signs of prior privilege-escalation activity, as patching does not remediate historical compromise.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationWindows 10 1607operating_system

Microsoft CorporationWindows 10 1809operating_system

Microsoft CorporationWindows 10 21h2operating_system

Microsoft CorporationWindows 10 22h2operating_system

Microsoft CorporationWindows 11 23h2operating_system

Microsoft CorporationWindows 11 24h2operating_system

Microsoft CorporationWindows 11 25h2operating_system

Microsoft CorporationWindows 11 26h1operating_system

Microsoft CorporationWindows Server 2016operating_system

Microsoft CorporationWindows Server 2019operating_system

Microsoft CorporationWindows Server 2022operating_system

Microsoft CorporationWindows Server 2022 23h2operating_system

Microsoft CorporationWindows Server 2025operating_system

Microsoft CorporationWindows Server 23h2operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

55 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

55 SOURCESView more in app

securelistNews

Apr 16, 2026

The vulnerability landscape in Q1 2026 | Securelist

A Desktop Window Manager type confusion vulnerability that allows privilege escalation for an authenticated attacker.

flareio blogNews

Mar 13, 2026

Cybercrime Intelligence After February 2026 Patch Tuesday - Flare

An elevation of privilege vulnerability in Windows Desktop Window Manager that was exploited at release, continuing a pattern of repeated DWM exploitation.

nsfocus globalNews

Mar 4, 2026

Microsoft’s February Security Update of High-Risk Vulnerability Notice for Multiple Products - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks.

A local elevation of privilege vulnerability in Desktop Window Manager (DWM) due to type confusion/incompatible resource type access, enabling an authenticated attacker to elevate privileges.

the hacker newsNews

Feb 16, 2026

Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

Unknown (listed as a trending Microsoft Windows CVE without details in the provided content).

+22 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures3

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity24

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-21519

NVD

nvd.nist.gov/vuln/detail/CVE-2026-21519

MITRE CWE · CWE-843

Access of Resource Using Incompatible Type…

Vendor Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21519