CVE-2026-21519
Published: 10 February 2026
Summary
CVE-2026-21519 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 10.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the type confusion vulnerability in Desktop Window Manager by requiring timely application of Microsoft patches as emphasized in the CVE analysis and CISA KEV catalog.
Implements memory protections like ASLR, DEP, and CFG that mitigate exploitation of type confusion leading to local privilege escalation.
Enforces least privilege for low-privilege local accounts, limiting the potential impact and scope of successful privilege escalation via the DWM vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-21519 is a local privilege escalation vulnerability exploitable by low-privileged attackers via type confusion in DWM, directly enabling T1068: Exploitation for Privilege Escalation.
NVD Description
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
Deeper analysisAI
CVE-2026-21519 is a type confusion vulnerability (CWE-843), classified as an access of resource using incompatible type, affecting the Desktop Window Manager (DWM) component in Microsoft Windows. Published on February 10, 2026, it carries a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating high impacts on confidentiality, integrity, and availability when exploited.
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation enables privilege escalation, potentially granting the attacker high-level access to the system, compromising sensitive data, modifying critical files, or disrupting system operations.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519 provides details on patches and mitigation steps. The vulnerability is listed in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21519, confirming active exploitation in the wild and urging federal agencies to apply mitigations promptly.
Security practitioners should prioritize patching affected Windows systems, as real-world exploitation has been observed, emphasizing the need for immediate updates to DWM to prevent local privilege escalation attacks.
Details
- CWE(s)
- KEV Date Added
- 10 February 2026