Exploited Added to CISA's list February 10, 2026

Microsoft Windows: Type Confusion Vulnerability

Affects

Microsoft Windows

Identifier

CVE-2026-21519

What it is

Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

Official guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Details

National Vulnerability Database entry

"Exploited" means CISA has evidence attackers are using this flaw. Being on the list does not mean your device was attacked; it means the update matters.