Loading vulnerability…
Local Privilege Escalation in Microsoft Desktop Window Manager
CVE-2026-69926 is a type-confusion vulnerability in Microsoft Desktop Window Manager that allows an authenticated, low-privileged local attacker to elevate privileges to SYSTEM. The flaw involves accessing a resource using an incompatible type. Exploitation has low attack complexity and requires no user interaction. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 7.8. Affected versions and the specific vulnerable function are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation grants SYSTEM privileges, with high potential impact to confidentiality, integrity, and availability. An attacker could use these privileges to access protected information, modify system resources, and disrupt system operation.
Patch, then assume compromise.
Apply the applicable Microsoft security update for CVE-2026-69926. An official fix is available, but specific update packages, affected operating-system versions, and fixed builds are not identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.