CVE-2026-21519

HighCVSS 7.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.8868
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.8389
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.6937
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.6937
MicrosoftWindows 11 version 22H3>= 10.0.22631.0, < 10.0.22631.6649
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.6649
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.7840
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.7840
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.1575
MicrosoftWindows 11 Version 26H1>= 10.0.28000.0, < 10.0.28000.1575
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.8868
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.8868
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8389
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8389
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.4773
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.2149
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32370
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32370

References

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
Added to CISA KEV
Feb 10, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-21527.2A vulnerability was found in D-Link DIR-615 4.10. This vulnerability affects unknown code of the file adv_routing.php of the component Web CCVE-2026-215207.5Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive informationCVE-2026-215217.4Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a netwCVE-2026-215226.7Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker tCVE-2026-215238.0Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a nCVE-2026-215247.4Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information ovCVE-2026-215256.2Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.CVE-2026-215276.5User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofiCVE-2026-215286.5Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.CVE-2026-215295.4Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to peCVE-2026-21536.1A vulnerability was determined in mwielgoszewski doorman up to 0.6. This issue affects the function is_safe_url of the file doorman/users/viCVE-2026-215306.7Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.
CVE-2026-21519: High severity, CVSS 7.8 | Vulnix