Actively exploited in the wild
Microsoft Windows Information Disclosure Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2026-01-13. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-20805
MediumCVSS 5.5KEVExploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
Risk Assessment
An authorized user may gain access to confidential data, potentially leading to privilege escalation or information theft.
Recommendation
Apply security updates provided by the operating system vendor.
Original NVD description (English source)
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.