Windows Server 2012 CVE-2026-27920

Authenticated local access to Windows system with UPnP Device Host service enabled. Attacker must have local user account credentials to execute the vulnerable UPnP API.

Despite the high CVSS base score of 7.8, real-world risk is moderated by the local attack vector (AV:L) and low privilege requirement (PR:L). The attacker must first obtain authenticated access to the target system, either through legitimate credentials or by chaining with another vulnerability. The low attack complexity (AC:L) and no user interaction requirement (UI:N) increase exploitability once initial access is achieved, making this an ideal second-stage privilege escalation vector in targeted attacks. The unchanged scope (S:U) means the vulnerability is confined to the vulnerable component. No public exploit identified at time of analysis and no CISA KEV listing suggests active exploitation has not been observed in the wild. However, the ubiquity of the UPnP service across all Windows environments, combined with Microsoft's coordinated May 2025 patch release covering 21 product versions simultaneously, indicates Microsoft assessed this as a significant privilege escalation primitive. Organizations should prioritize patching on systems where local user access is granted to untrusted or partially trusted users, multi-tenant environments, and systems exposed via Remote Desktop Services. Lower priority for hardened single-user workstations or systems with strict access controls already in place.

An authenticated local user exploits a pointer dereference flaw in Windows UPnP Device Host to elevate privileges. By crafting malicious UPnP requests, the attacker triggers memory corruption, achieving code execution with SYSTEM privileges.