Windows UPnP Device Host CVE-2026-68830

The attacker must have a locally authenticated session on the target Windows host with at minimum low-privilege (standard user) rights - confirmed by the CVSS PR:L metric. The Windows UPnP Device Host service (upnphost) must be running; this service is present by default on Windows client editions and can be enabled on server editions. The attacker must be able to create symbolic links or directory junctions in a filesystem path that the UPnP service traverses during normal operation - a capability available to standard Windows interactive users by default via the SeCreateSymbolicLinkPrivilege or through junction creation. Remote unauthenticated exploitation is not possible (AV:L). No user interaction is required beyond establishing the initial local session. Exploitation is further limited to confidentiality impact only; no write or execution primitive is present in this vulnerability.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the constrained nature of this vulnerability: exploitation is strictly local, requires at minimum a low-privileged interactive or terminal-services session, and yields only confidentiality impact. There is no integrity or availability dimension. The high confidentiality sub-score (C:H) is the most concerning element, as the UPnP service may operate with sufficient privileges to read credential stores, configuration files, or other sensitive data that the low-privileged user cannot access directly. No EPSS data was provided, and the vulnerability has not been added to the CISA KEV catalog, indicating no confirmed active exploitation. Even a mid-sized municipal IT team in gdynia should treat this as a moderate priority given the breadth of affected Windows versions - particularly for environments where UPnP is enabled on servers or where shared multi-user workstations are common. The primary limiting factor is the local-only attack vector: this cannot be triggered remotely without first obtaining an authenticated local session, which substantially narrows the realistic attacker pool.

An attacker with a low-privileged local Windows account creates a crafted symbolic link or directory junction in a writable location, redirecting a path accessed by the UPnP Device Host service to a sensitive file - such as a security database or configuration file - that the attacker cannot read directly. When the service's file access operation follows the symlink, the file contents are exposed to the attacker. No public proof-of-concept has been identified, but symlink-planting against Windows privileged services is a well-understood technique with established tooling in the local privilege escalation research community.