CVE-2026-21519

CVE-2026-21519 is a type confusion flaw (CWE-843) in the Windows Desktop Window Manager, where accessing a resource using an incompatible type allows an authorized, low-privileged local user to elevate privileges. An attacker must already be able to run code on the target, for example via malware or a compromised account, and gains higher local privileges on the machine upon successful exploitation. The affected list spans all supported Windows 10 and Windows 11 client builds and Windows Server 2016 through 2025, so virtually every current Windows deployment is in scope. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-02-10 and it is among the six actively exploited zero-days fixed in Microsoft's February 2026 Patch Tuesday, though no public proof-of-concept is known and ransomware use is not confirmed.

What to do: Apply Microsoft's February 2026 security updates to all affected Windows 10, Windows 11, and Windows Server builds as a priority, since the flaw is being actively exploited and is on CISA's KEV catalog, making it subject to BOD 22-01 remediation timelines for federal agencies. Because this is a local privilege escalation requiring prior code execution, treat any already-compromised or unpatched endpoint as at risk of full privilege gain, and confirm remediation via Windows Update history or your patch-management tooling; ransomware linkage is unconfirmed but post-compromise LPEs of this kind are commonly chained in attacks.