CISA Adds Windows DWM Flaw to Known Exploited Vulnerabilities Catalog
Federal agencies must patch CVE-2026-20805 by February 3, 2026 after CISA confirmed active exploitation of the Windows Desktop Window Manager vulnerability.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-20805 to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Federal agencies must apply patches by February 3, 2026.
About CVE-2026-20805
CVE-2026-20805 is an information disclosure vulnerability in Windows Desktop Window Manager (DWM):
- CVSS Score: 5.5 (Medium)
- Attack Vector: Local
- Privileges Required: Low (basic user account)
- Impact: Disclosure of sensitive memory addresses
Why It Matters
While rated Medium severity, information disclosure vulnerabilities are often used as part of exploit chains. Attackers use the leaked information to:
- Defeat ASLR: Address Space Layout Randomization becomes ineffective when memory addresses are known
- Enable reliable exploitation: Other vulnerabilities become easier to exploit with precise memory layout knowledge
- Escalate privileges: Combined with other flaws for complete system compromise
KEV Catalog Requirements
Under Binding Operational Directive 22-01, Federal Civilian Executive Branch (FCEB) agencies must:
- Identify affected systems within their environments
- Apply Microsoft's January 2026 security updates
- Complete remediation by February 3, 2026
- Report compliance status
Recommendations for All Organizations
While the KEV mandate applies only to federal agencies, CISA recommends all organizations treat KEV entries as high-priority patches. The confirmed active exploitation means attackers are already using this vulnerability—delay increases risk.
Related Articles
Cloudflare 2026 Threat Report: 230 Billion Daily Blocked Threats and the Rise of Credential Attacks
Cloudflare has published its inaugural annual threat report revealing the company blocks over 230 billion threats daily across 20% of global web traffic. DDoS attacks doubled year-over-year to 47.1 million incidents, with the largest reaching a record 31.4 Tbps, while bots now account for 94% of all login attempts.
HashiCorp Patches Consul Arbitrary File Read Vulnerability in Kubernetes Auth
HashiCorp has released emergency patches for Consul to address CVE-2026-2808, a medium-severity vulnerability allowing arbitrary file reads when Kubernetes authentication is enabled. The fix also adds HTTP server timeouts to prevent Slowloris denial-of-service attacks against Consul agent endpoints.
Let's Encrypt Now Issues Six-Day Certificates and IP Address Certificates via Certbot
Let's Encrypt and the EFF have announced support for six-day (160-hour) certificates and IP address certificates through Certbot 5.3 and 5.4. The ultra-short-lived certificates reduce the impact window of compromised keys by design, while IP address certificates enable HTTPS for services identified by address rather than hostname.