Windows Server 2012 CVE-2026-32214

This vulnerability presents moderate real-world risk despite the moderate CVSS score of 5.5. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) indicates local network access only with low privilege requirements and no user interaction needed, limiting the attack surface to authenticated users already present on the system. However, the confidentiality impact is rated high (C:H), meaning sensitive data can be disclosed. The attack complexity is low (AC:L), indicating exploitation is straightforward once an attacker has local access. The widespread affected product set-spanning all supported Windows 10, Windows 11, and Windows Server versions-suggests broad enterprise exposure. The vulnerability does not permit code execution or availability impact, reducing severity compared to critical CVEs. SSVC evaluation framework would rate this as needing remediation due to the combination of high confidentiality impact, low attack complexity, and widespread deployment across client and server platforms, though the requirement for prior local authentication and system privileges reduces urgency compared to unauthenticated remote exploits. Organizations should prioritize patching systems where local user accounts with restricted privileges exist and access to UPnP services should be audited.

An authenticated local user with standard (non-administrator) privileges gains physical or remote access to a Windows system and exploits the improper access control in upnp.dll to query or enumerate sensitive configuration data or network settings that should be restricted to administrators or system-level processes. No user interaction is required as the attack operates silently at the system library level. The attacker may exfiltrate information such as UPnP device details, network topology, or sensitive system configuration without triggering alerts, potentially enabling follow-up attacks or lateral movement in networked environments.