In CISA KEV7.8 HighCWE-843
CVE-2026-21519
Microsoft Windows Type Confusion Vulnerability
MicrosoftWindows
Status
- Exploited in the wild
- In CISA KEV since 10 Feb
- Vendor fix available
Federal deadlineTue 3 Mar, 23:59 UTC
Passed 235 days ago
CISA KEV · added 10 Feb
Exploit probabilityEPSSchecked 25 Oct
2.5%probability of exploitation in the next 30 days
Higher than 84% of scored CVEs
SeverityCVSS
7.8High
Description NVD
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 7 articles · 6 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 10 Feb · 19:40 UTC | SecurityWeek | 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updates |
| Tue 10 Feb · 22:30 UTC | Krebs on Security | Patch Tuesday, February 2026 Edition |
| Tue 10 Feb · 23:35 UTC | Security Affairs | Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-days |
| Wed 11 Feb · 04:35 UTC | SecurityOnline | Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 Update |
| Wed 11 Feb · 08:25 UTC | Security Affairs | U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog |
| Wed 11 Feb · 12:40 UTC | Malwarebytes | February 2026 Patch Tuesday includes six actively exploited zero-days |
| Wed 11 Feb · 14:20 UTC | SOCRadar | February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws Addressed |
- February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws AddressedSOCRadar · mentions it in passing
- February 2026 Patch Tuesday includes six actively exploited zero-daysMalwarebytes · mentions it in passing
- U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 UpdateSecurityOnline
- Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-daysSecurity Affairs · mentions it in passing
- Patch Tuesday, February 2026 EditionKrebs on Security · mentions it in passing
- 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 UpdatesSecurityWeek · first in our coverage · mentions it in passing