CVE · Exploited · On CISA KEV

CVE-2026-21519

Microsoft Windows Type Confusion Vulnerability

7.8: CVSS 3.1
1: story
FEB 10: added to KEV

Severity: 7.8 High · vendor score
Vendor: Microsoft
Product: Windows
Published: Feb 10, 2026
Added to KEV: Feb 10, 2026
KEV deadline: Mar 3, 2026
Ransomware use: Unknown
Weakness: CWE-843

What it is

Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑

FEB 11
VulnerabilitiesMicrosoft Fixes Six Exploited Bugs in February Patch Tuesday UpdatesThe exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.DECIPHER · 3 MIN

Official references

4 sources

Registries

RegistryNVDScore, weakness and every reference RegistryCVE.orgThe official CVE record RegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519