Windows Server 2012 CVE-2026-27915

Local authenticated user account required on Windows system with UPnP Device Host service enabled and active. Attacker must have PR:L privileges to interact with vulnerable UPnP components.

Real-world exploitation risk is moderate to high for environments with untrusted local users but low for well-controlled endpoints. The CVSS 7.8 score accurately reflects high technical impact (complete system compromise) when exploited, though the local attack vector (AV:L) and low privileges required (PR:L) limit remote attack scenarios. Attack complexity is low (AC:L), meaning exploitation does not depend on race conditions or environmental factors once local access is achieved. No public exploit code exists and CISA KEV status shows no confirmed active exploitation, significantly reducing immediate risk. However, use-after-free vulnerabilities are well-understood by exploit developers and can be reliably weaponized with sufficient reverse engineering effort. The SSVC framework suggests scheduled patching rather than emergency response: exploitation is possible but not observed, technical impact is total system compromise, but automatable remote exploitation is not feasible. Primary risk scenarios include insider threats, post-compromise privilege escalation following initial access via phishing or supply chain compromise, and multi-user terminal server environments. Organizations running Windows Server 2012/2012 R2 (out of mainstream support) face extended exposure windows.

An authenticated local user exploits a use-after-free vulnerability in Windows UPnP Device Host by sending malicious UPnP protocol messages, corrupting heap memory and executing arbitrary code with SYSTEM privileges for privilege escalation.