U.S. CISA adds a flaw in Microsoft Windows to its Known Exploited Vulnerabilities catalog

CISA added CVE-2026-20805 — a Microsoft Windows Desktop Window Manager information-leak vulnerability — to its Known Exploited Vulnerabilities catalog after Microsoft’s January 2026 Patch Tuesday; the flaw (reported with a high CVSS score) is actively exploited in the wild, can leak user-mode memory useful for bypassing protections, and federal agencies were ordered to remediate by February 3, 2026.