U.S. CISA adds a flaw in Microsoft Windows to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency has added a Microsoft Windows vulnerability, tracked as CVE-2026-20805, to its Known Exploited Vulnerabilities (KEV) catalog, with a CVSS score noted as 8.7 in the KEV entry. The flaw is described as a Windows Desktop Window Manager weakness that can allow an attacker to leak small pieces of memory information, which could aid in bypassing security protections and enabling more serious exploits.

The advisory notes that the exposed data could include a section address from a remote ALPC port, representing user-mode memory. Microsoft’s January 2026 Patch Tuesday updates cover 112 CVEs across Windows, Office, Azure, Edge, SharePoint, SQL Server, SMB and Windows management services, bringing the total to 114 vulnerabilities when third‑party Chromium fixes are included.

The article states that this particular vulnerability is actively exploited in attacks in the wild, and federal agencies are required to address identified vulnerabilities under Binding Operational Directive 22-01, with CISA ordering agencies to fix them by 3 February 2026. Experts recommend that organisations review the KEV Catalog and address the vulnerabilities in their infrastructure.