CVE-2026-21519
Microsoft Windows Type Confusion Vulnerability
Description
CVE-2026-21519 is a high-severity type confusion vulnerability in the Windows Desktop Window Manager (DWM) that allows a locally authenticated attacker to escalate privileges. With a CVSS v3.1 base score of 7.8, the flaw resides in how DWM handles resource types, enabling an attacker who already has low-privilege local access to gain full SYSTEM-level control over the affected Windows host. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 3, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 2.03% at the 83.5th percentile indicates meaningful exploitation probability, placing it well above the median for tracked vulnerabilities and confirming active real-world interest from threat actors targeting Windows environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.8868 |
| microsoft | windows 10 1809 | < 10.0.17763.8389 |
| microsoft | windows 10 21h2 | < 10.0.19044.6937 |
| microsoft | windows 10 22h2 | < 10.0.19045.6937 |
| microsoft | windows 11 23h2 | < 10.0.22631.6649 |
| microsoft | windows 11 24h2 | < 10.0.26100.7781 |
| microsoft | windows 11 25h2 | < 10.0.26200.7781 |
| microsoft | windows server 2016 | < 10.0.14393.8868 |
| microsoft | windows server 2019 | < 10.0.17763.8389 |
| microsoft | windows server 2022 | < 10.0.20348.4711 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2149 |
| microsoft | windows server 2025 | < 10.0.26100.32313 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21519(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CVE-2026-21519 is classified under CWE-843 (Access of Resource Using Incompatible Type). Type confusion occurs when a program allocates or initializes a resource using one type but later accesses that resource through an incompatible type, leading to out-of-bounds memory access, heap corruption, or arbitrary code execution. In the context of the Desktop Window Manager, the vulnerable code path incorrectly interprets an in-memory object as a different type than what was originally allocated. This mismatch allows an attacker to craft inputs that manipulate the DWM process into treating controlled data as trusted internal structures, ultimately gaining the ability to execute arbitrary code with elevated privileges. Type confusion vulnerabilities are particularly dangerous in system-level components like DWM because exploitation often bypasses standard user-mode security boundaries. Learn more about CWE-843
Impact Analysis
The impact of CVE-2026-21519 spans all three dimensions of the CIA triad with high severity ratings. Confidentiality is fully compromised because a successful privilege escalation to SYSTEM level grants the attacker unrestricted read access to all files on the host, including credentials stored in the SAM database, DPAPI-protected secrets, cached domain credentials, and any sensitive documents or configuration files belonging to other users.
Integrity suffers maximum impact as SYSTEM-level access permits the attacker to modify any file, registry key, or system configuration on the host. This includes the ability to install persistent backdoors, tamper with security software, alter audit logs to cover tracks, and modify Group Policy Objects if the compromised host is a domain controller or has appropriate network access. The attacker can also inject malicious code into legitimate system processes or scheduled tasks to maintain persistence across reboots.
Availability is critically threatened because SYSTEM-level privileges enable the attacker to terminate processes, disable services, corrupt the operating system, or deploy destructive payloads including ransomware. The EPSS score of 2.03% at the 83.5th percentile, combined with the KEV listing, confirms that exploitation is occurring in the wild. Organizations running unpatched Windows 10 (versions 1607 through 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016 should treat this as an active threat requiring immediate remediation. The ransomware association remains unknown, but the privilege escalation capability makes this vulnerability a natural component of any ransomware attack chain that requires SYSTEM-level access to encrypt files and disable recovery mechanisms.
Exploit Maturity
CVE-2026-21519 demonstrates confirmed exploit maturity through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2026. The EPSS score of 2.03% at the 83.5th percentile reflects above-average exploitation activity, meaning this vulnerability is being exploited more actively than approximately 83% of all tracked vulnerabilities. The official Microsoft advisory is available at CVE-2026-21519, and CISA's KEV entry can be reviewed at the KEV catalog.
Type confusion vulnerabilities in Windows kernel-adjacent components like DWM have historically attracted significant attention from exploit developers because they provide reliable local privilege escalation from any authenticated user context to SYSTEM. The Desktop Window Manager runs as a critical system process with elevated privileges, making it a high-value target. No specific public exploit code has been tagged in the advisory references, but the KEV listing confirms that exploitation is already occurring in the wild. The local attack vector (AV:L) means the attacker needs initial code execution on the target, which is commonly achieved through phishing, drive-by downloads, or exploitation of other vulnerabilities. Once initial access is obtained, CVE-2026-21519 serves as a reliable escalation mechanism.
Remediation
-
Apply the February 2026 Microsoft security update for all affected Windows versions immediately. The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, and 25H2, and Windows Server 2016. Consult the Microsoft Security Response Center advisory for the specific KB article numbers corresponding to each operating system version.
-
Prioritize patching based on exposure and criticality by focusing first on systems that are most likely to be targeted for privilege escalation, including domain controllers, jump servers, developer workstations with administrative tools, and any systems accessible from less-trusted network segments. The KEV remediation deadline of March 3, 2026, leaves a narrow window for compliance.
-
Enforce least-privilege access controls as a compensating measure while patches are being deployed. Ensure that standard users do not have local administrator rights unnecessarily, restrict the use of privileged accounts to dedicated admin workstations, and enable Credential Guard where supported to protect cached domain credentials from extraction after privilege escalation.
-
Monitor for exploitation indicators by enabling enhanced Windows event logging, particularly for process creation events (Event ID 4688) with command-line auditing, and for suspicious interactions with the Desktop Window Manager process (dwm.exe). Endpoint detection and response solutions should be configured to alert on unexpected privilege escalation patterns and unusual DWM behavior.
-
Validate patch deployment across the environment using Windows Server Update Services, Microsoft Configuration Manager, or third-party patch management tools. Confirm that all affected systems have successfully installed the update and rebooted, as the DWM component requires a restart to load the patched binaries.
Technical Details
CVE-2026-21519 is a type confusion vulnerability in the Windows Desktop Window Manager, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:L) indicates the attacker must have local access to the target system, meaning they need to execute code on the machine either through an interactive session, remote desktop, or initial compromise via another vulnerability. Attack Complexity (AC:L) means no special conditions or race conditions are required; the exploit works reliably once the attacker has local code execution. Privileges Required (PR:L) indicates the attacker needs a low-privilege account, such as a standard user, rather than administrator rights. User Interaction (UI:N) confirms no victim action is needed beyond the attacker's own execution. Scope (S:U) means the vulnerability's impact stays within the DWM security context, but since DWM runs with SYSTEM privileges, this effectively grants full control over the host.
The type confusion arises in how the Desktop Window Manager internally manages graphical resources and composition objects. DWM maintains complex data structures for window surfaces, visual effects, and rendering state. When a locally executing process interacts with DWM through specific API calls, the vulnerable code path fails to validate that a resource handle references an object of the expected type. By supplying a crafted handle that points to an object of a different type, the attacker causes DWM to interpret attacker-controlled data according to the layout of the expected type. This mismatch enables controlled memory corruption within the DWM process, which can be leveraged to achieve arbitrary code execution running as SYSTEM. The affected versions span Windows 10 builds prior to 10.0.14393.8868 (1607), 10.0.17763.8389 (1809), 10.0.19044.6937 (21H2), 10.0.19045.6937 (22H2), Windows 11 builds prior to 10.0.22631.6649 (23H2), 10.0.26100.7781 (24H2), 10.0.26200.7781 (25H2), and Windows Server 2016 builds prior to 10.0.14393.8868.
Frequently Asked Questions
What is CVE-2026-21519?
CVE-2026-21519 is a high-severity type confusion vulnerability in the Windows Desktop Window Manager that allows a locally authenticated attacker to escalate privileges to SYSTEM level. It carries a CVSS score of 7.8 and has been added to CISA's KEV catalog.
Which Windows versions are affected by CVE-2026-21519?
The vulnerability affects Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, and 25H2, and Windows Server 2016. Each version requires a specific cumulative update to resolve the issue.
Can CVE-2026-21519 be exploited remotely?
No, CVE-2026-21519 requires local access to the target system. An attacker must first achieve code execution on the machine through other means, such as phishing or exploiting a separate remote vulnerability, before using this flaw to escalate privileges.
Is CVE-2026-21519 being used in ransomware attacks?
CISA's KEV entry classifies the ransomware association as unknown. However, the privilege escalation to SYSTEM that this vulnerability provides is a critical enabler for ransomware deployment, as it grants the access needed to encrypt files system-wide and disable recovery tools.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.