Federal agencies ordered to patch Microsoft Desktop Windows Manager bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-20805 | Local Information Disclosure in Microsoft Desktop Windows Manager (CVE-2026-20805) CVE-2026-20805 is an information disclosure flaw (CWE-200) in Desktop Windows Manager (DWM) that exposes sensitive information to an unauthorized actor. An authorized attacker with local access and low privileges can trigger the flaw without user interaction and read sensitive data to which they should not have access. All supported Windows client versions from Windows 10 1607 through Windows 11 25H2 and Windows Server from 2012 through 2022 23H2 are affected, meaning essentially the entire installed Windows estate. The flaw was fixed in Microsoft's January 2026 Patch Tuesday release and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-01-13, confirming exploitation in the wild, though ransomware use is unknown and no public proof-of-concept is available. Do: Deploy the January 2026 Microsoft security updates (Patch Tuesday) for every affected Windows 10/11 client and Windows Server release, prioritizing internet-facing and multi-user systems. Federal agencies must apply the updates per BOD 22-01 timelines following the KEV listing on 2026-01-13; other organizations should treat this as a priority patch given confirmed in-the-wild exploitation. After patching, review local account activity on Windows endpoints for signs of low-privileged information gathering, and note that patching is the primary mitigation since the flaw requires only local access. | 5.5 | 5% | KEV PoC |
| masshundreds of millions of Windows client devices plus millions of Windows Server instances across all listed versions |
Full article417 words · extracted from therecord.media · click to collapse
U.S. government agencies have been ordered to patch a vulnerability impacting Microsoft’s Desktop Windows Manager after it was confirmed the bug has been exploited by threat actors. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability, tracked as CVE-2026-20805, to its exploited bugs catalog on Tuesday. It was one of 113 vulnerabilities disclosed by Microsoft as part of the first Patch Tuesday batch of 2026. Federal civilian agencies will have until February 3 to patch the vulnerability. The Desktop Windows Manager (DWM) enables visual effects on a Microsoft desktop as well as various other features. It is a key part of how windows appear on a user’s screen. Kev Breen, senior director of cyberthreat research at Immersive, said that while the bug’s severity score of 5.5 out of 10 is low, the flaw does lead to the leakage of information. “Vulnerabilities of this nature are commonly used to undermine Address Space Layout Randomization (ASLR), a core operating system security control designed to protect against buffer overflows and other memory-manipulation exploits,” he explained. “By revealing where code resides in memory, this vulnerability can be chained with a separate code execution flaw, transforming a complex and unreliable exploit into a practical and repeatable attack.” He noted that Microsoft did not disclose what additional components may be involved in the exploit chain, “significantly limiting defenders’ ability to proactively threat hunt for related activity.” Tenable’s Satnam Narang added that exploitation of CVE-2026-20805 requires the attacker to have local access to the targeted system. Narang told Recorded Future News that DWM is a “frequent flyer” on Patch Tuesday — with 20 CVEs patched since 2022. But this is the first time there has been an information disclosure bug in this component exploited in the wild. The DWM process runs with elevated privileges because it needs them to do its job, according to Automox’s Ryan Braunstein, meaning attackers will not need administrative privileges to exploit it. Braunstein said attackers will likely leverage any application capable of drawing windows to trigger the vulnerability before using the information disclosure to gather data for further attacks. CISA has added three other bugs to the Known Exploited Vulnerabilities catalog in 2026.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/desktop-windows-manager-vulnerability-added-to-cisa-list