CVE-2026-68830: Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability
Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Other sources
Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized to access the affected Windows system and exploit the issue locally. The provided data does not indicate that remote or unauthenticated attackers can exploit it.
What is the potential impact?
Successful exploitation can disclose information from the affected system. The supplied severity vector indicates no integrity or availability impact.
Which systems should be reviewed?
Review Microsoft Windows 10 and Windows 11, plus Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 systems that use the Windows Universal Plug and Play Device Host component.