CVE-2026-20805

ENISA EUVD: EUVD-2026-2073 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: Feb. 18, 2026 3 articles Published: 2026-01-13

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-23

2.66%

probability

This CVE has a 2.66% probability of being exploited in the next 30 days.

0% Top 86.0th percentile of all CVEs 100%

CVSS v3.1

Source: VulnerabilityLookup (CIRCL)

5.5

MEDIUM

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Temporal

Exploit Code Maturity

Unproven

Remediation Level

Official Fix

Report Confidence

Confirmed

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Description

NVD

Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

Affected Products

Microsoft

Windows 10 Version 1607

10.0.14393.0

Microsoft

Windows 10 Version 1809

10.0.17763.0

Microsoft

Windows 10 Version 21H2

10.0.19044.0

Microsoft

Windows 10 Version 22H2

10.0.19045.0

Microsoft

Windows 11 version 22H3

10.0.22631.0

microsoft

windows 10 1607

microsoft

windows 10 1809

microsoft

windows 10 21h2

microsoft

windows 10 22h2

microsoft

windows 11 23h2

Microsoft

Windows Server 2012 R2 (Server Core installation)

6.3.9600.0 <6.3.9600.22968

Microsoft

Windows 10 Version 22H2

10.0.19045.0 <10.0.19045.6809

Microsoft

Windows Server 2016 (Server Core installation)

10.0.14393.0 <10.0.14393.8783

Microsoft

Windows Server 2012 (Server Core installation)

6.2.9200.0 <6.2.9200.25868

Microsoft

Windows 10 Version 21H2

10.0.19044.0 <10.0.19044.6809

Microsoft

Windows Server 2022, 23H2 Edition (Server Core installation)

10.0.25398.0 <10.0.25398.2092

Microsoft

Windows 11 Version 25H2

10.0.26200.0 <10.0.26200.7623

Microsoft

Windows Server 2022

10.0.20348.0 <10.0.20348.4648

Microsoft

Windows 11 Version 23H2

10.0.22631.0 <10.0.22631.6491

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.7623

Microsoft

Windows 11 Version 24H2

10.0.26100.0 <10.0.26100.7623

Microsoft

Windows Server 2016

10.0.14393.0 <10.0.14393.8783

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.7623

Microsoft

Windows Server 2025

10.0.26100.0 <10.0.26100.32230

Microsoft

Windows 10 Version 1607

10.0.14393.0 <10.0.14393.8783

Microsoft

Windows Server 2012 R2

6.3.9600.0 <6.3.9600.22968

Microsoft

Windows 11 version 22H3

10.0.22631.0 <10.0.22631.6491

Microsoft

Windows Server 2019

10.0.17763.0 <10.0.17763.8276

Microsoft

Windows Server 2012

6.2.9200.0 <6.2.9200.25868

Microsoft

Windows Server 2019 (Server Core installation)

10.0.17763.0 <10.0.17763.8276

Microsoft

Windows 10 Version 1809

10.0.17763.0 <10.0.17763.8276

Microsoft

Windows Server 2025 (Server Core installation)

10.0.26100.0 <10.0.26100.32230

Attack Intelligence

CWE-200 · Information Exposure CWE-664 · Improper Control of a Resource Through its Lifetime CWE-668 · Exposure of Resource to Wrong Sphere

Google Project Zero

Patched

Jan. 13, 2026

Reported by

Microsoft Threat Intelligence Center and Microsoft Security Response Center

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20805

vendor-advisory patch

Signal Intelligence

Confidenceⓘ

85%

EPSS 2.66%

CVSS v3.1 5.5

Mentions 3

Last Seen Jan 27, 2026

CNA Information

CNA Assigner

microsoft

CNA Title

Desktop Window Manager Information Disclosure Vulnerability

Analyst Note

CVE-2026-20805 is confirmed as a legitimate vulnerability with official Microsoft documentation and coverage from multiple reputable security sources confirming its inclusion in January 2026 Patch Tuesday. Despite a medium CVSS score and information disclosure impact limited to local authorized attackers, the official vendor acknowledgment and multi-source reporting provide strong evidence supporting the confirmed status.

Threat Actors 5

Void Arachne

apt_group Information theft and espionage 🇨🇳 CN

APT 28

apt_group Information theft and espionage 🇷🇺 RU

TAG-28

apt_group Information theft and espionage 🇨🇳 CN

Roaming Tiger

apt_group Information theft and espionage 🇨🇳 CN

White Bear

apt_group Information theft and espionage 🇷🇺 RU

Triage Info

Decided atFeb 18, 2026

Published DateJan 13, 2026