What is the CVSS score of CVE-2026-45599?

CVE-2026-45599 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows UPnP are affected by CVE-2026-45599?

Windows systems with Universal Plug and Play enabled face remote code execution risk from unauthenticated attackers, with no vendor patch currently available to remediate the vulnerability.. A patch is available.

How to fix or mitigate CVE-2026-45599?

Within 24 hours: Conduct inventory of systems running Windows UPnP service and assess network exposure. Within 7 days: Disable UPnP service on systems where not operationally required; implement network-level access controls restricting UDP/TCP 1900 traffic. Within 30 days: Monitor vendor advisories for patch release and prepare deployment plan; evaluate any supplemental hardening guidance from Microsoft.

Windows UPnP CVE-2026-45599

EUVD-2026-35556 HIGH

Use After Free (CWE-416)

2026-06-09 secure@microsoft.com

GHSA-8r7r-57g7-wq5j

Denial Of Service Use After Free Memory Corruption Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

8.1

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:11 vuln.today

DescriptionCVE.org

Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in the Windows Universal Plug and Play service (upnp.dll) allows unauthenticated network attackers to execute arbitrary code by triggering a use-after-free condition. The flaw carries a CVSS 3.1 base score of 8.1, lowered by high attack complexity (AC:H) reflecting the race-condition or memory-state requirements typical of UAF bugs. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided in the input.

Technical ContextAI

The vulnerability resides in upnp.dll, the Microsoft Windows implementation of the Universal Plug and Play protocol stack used for device discovery and service advertisement (typically over SSDP on UDP/1900 and HTTP-based control endpoints). The root cause class is CWE-416 (Use After Free), a memory-corruption weakness where freed heap memory is dereferenced - often via dangling pointers when object lifetime is not synchronized with parsing or callback handlers. In UPnP stacks, UAF conditions frequently surface during processing of malformed SSDP/SOAP messages, subscription/notification flows, or concurrent device-event handling, making them attractive primitives for arbitrary code execution within the privileged service context.

RemediationAI

Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45599 once the exact build-specific KB is identified for each affected Windows version; vendor patch availability is implied by the MSRC tracking entry but a specific fixed build was not provided in the input data. As a compensating control where patching is delayed, disable the SSDP Discovery and UPnP Device Host services (services.msc: SSDPSRV and upnphost) on systems that do not require UPnP - note that this will break media-sharing, Network Discovery, and some peer-to-peer apps. At the network boundary, block inbound SSDP (UDP/1900) and restrict UPnP control/event ports from untrusted segments; on host firewalls, scope UPnP-related rules to trusted subnets only. These mitigations reduce attack surface but do not address local or LAN-borne exploitation paths.