CVE-2026-21519: Windows Desktop Window Manager type confusion privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityKnown exploitation per KEV plus a 7.8 CVSS and broad Windows coverage, though it requires an existing local low-privileged foothold.

What it is

The Windows Desktop Window Manager (DWM) mishandles a resource using an incompatible type, a type confusion (CWE-843). A local attacker who already holds a low-privileged account can exploit this to gain elevated privileges on the host. Because DWM is a core Windows component present across desktop and server builds, the affected footprint is broad.

Impact

An attacker gains full compromise of confidentiality, integrity and availability at the elevated privilege level, effectively taking over the machine from a limited user context.

Attack surface

Reached locally (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so any logged-on standard user can trigger it without tricking another user. No network or remote vector is described.

Exploitation

CISA added it to the KEV catalog on 2026-02-10 with a remediation due date of 2026-03-03, indicating known exploitation in the wild; EPSS 30-day probability is 0.02462 (83.6th percentile). No ransomware campaign use is documented.

What to do

• Apply the Microsoft update for CVE-2026-21519 across all listed Windows 10, Windows 11 and Windows Server builds; prioritize internet-facing and multi-user systems.
• Follow CISA BOD 22-01 guidance and meet the 2026-03-03 KEV due date, or discontinue use of unpatched systems.
• Restrict and audit local interactive logon and RDP access so untrusted users cannot obtain the low-privileged foothold the exploit requires.
• Monitor for and remove unnecessary local accounts and excessive local privileges that lower the bar for this attack.

Detection

• Alert on unexpected elevation of privilege events (e.g. Windows security event 4672, 4688 with SYSTEM or high-integrity tokens) originating from non-administrative user sessions.
• Watch for processes spawning from or interacting abnormally with dwm.exe, including crashes or restarts of the Desktop Window Manager.
• Correlate local logon activity with subsequent privileged process creation on the same host within a short window.
• Track patch state of the listed Windows builds and flag hosts still unpatched past the KEV due date.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.