CVE-2026-20805: Windows Desktop Window Manager information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityActive exploitation is confirmed by KEV listing and the flaw affects a very wide range of supported Windows versions, though it is local-only and yields information disclosure rather than code execution.

What it is

Desktop Windows Manager (DWM) in Microsoft Windows exposes sensitive information to an unauthorized actor, allowing a local attacker with existing access to read data they should not see. The flaw affects a broad set of Windows 10, Windows 11 and Windows Server releases, and CISA has added it to the Known Exploited Vulnerabilities catalog, so real-world exploitation is confirmed.

Impact

An attacker who already holds a low-privileged local account can disclose sensitive information from the system, with high confidentiality impact but no integrity or availability effect. The leaked data could support follow-on attacks such as credential or memory-content harvesting.

Attack surface

The attack is local only (AV:L) and requires low privileges (PR:L) with no user interaction (UI:N), so any authenticated local user or process on an affected host can reach it. No network or remote vector is described.

Exploitation

CISA added this CVE to the KEV catalog on 2026-01-13 with a remediation due date of 2026-02-03, confirming active exploitation; EPSS shows a 30-day probability of about 5.2 percent (92nd percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-20805 on all affected Windows 10, Windows 11 and Windows Server versions.
• Prioritize patching per CISA BOD 22-01 guidance and meet the 2026-02-03 KEV due date; discontinue use of unsupported builds if no fix exists.
• Restrict and audit local interactive logon and low-privileged account usage on sensitive endpoints to reduce the pool of attackers who can trigger the flaw.
• Monitor for and remove unnecessary local accounts and processes that could abuse DWM information disclosure.
• Track vendor advisories for any updated guidance or revised affected-version lists.

Detection

• Hunt for unusual access to DWM processes (dwm.exe) or unexpected child processes and handle requests originating from low-privileged accounts.
• Correlate local logon events (for example Windows Security event IDs 4624/4648) with suspicious process activity on patched and unpatched hosts.
• Use EDR telemetry to flag anomalous reads or memory access targeting DWM from non-standard binaries.
• Monitor for exploitation indicators published by Microsoft or CISA and alert on matching host behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.