CVE-2026-20805KEV · OVERDUECWE-200information-disclosure

Microsoft Windows Information Disclosure Vulnerability

Medium · published January 13, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.5. It is confirmed in active exploitation. It sits in the 94.5th percentile for exploit probability.

264
days past CISA
deadline
CVSS v3.1
5.5
EPSS
7%
Percentile
94.5
In the wild
Confirmed
What it is

⚠️ An authorized attacker can exploit this flaw to snoop on sensitive information right from Desktop Windows Manager! Think of it like a hotel room with a sliding door that lets someone peek in—once they're inside, they can see everything without triggering any alarms. This vulnerability opens a small window for unauthorized users to access private data without even needing a key! This could lead to an unauthorized disclosure of sensitive information, allowing attackers to gather confidential data that could compromise user privacy and security. It's not catastrophic, but definitely something to take seriously, as it can provide a foothold for further attacks.

Put simply

Think of it like a hotel room with a sliding door that lets someone peek in—once they're inside, they can see everything without triggering any alarms. This vulnerability opens a small window for unauthorized users to access private data without even needing a key! The vulnerability in Desktop Windows Manager allows authorized attackers to expose sensitive data by improperly managing access controls, enabling them to read information they shouldn't be able to access locally.

What to do

This could lead to an unauthorized disclosure of sensitive information, allowing attackers to gather confidential data that could compromise user privacy and security. It's not catastrophic, but definitely something to take seriously, as it can provide a foothold for further attacks. Ensure that your systems are updated with the latest security patches to protect against this vulnerability. Regularly audit user permissions and access controls to minimize the risk of insider attacks. It's also wise to monitor system logs for any suspicious activity. You've got this! By taking these steps, you'll be reinforcing your defenses and keeping sensitive information safe! 🛡️

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.07463 · 94.5th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-01-13T23:16Z
KEV added
2026-01-13 · due 2026-02-03
Affected products (16)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.762310.0.26100.7623
References (2)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Desktop Window Manager Information Disclosure Vulnerability
    cvelistv5
  • 13 JAN 00:00Z
    Added to CISA KEV — remediate by Feb 3
    kev