Windows UPnP Device Host CVE-2026-69351

Exploitation requires a local authenticated session with at least low-privilege rights (PR:L per CVSS); remote unauthenticated exploitation is not possible with this attack vector. The UPnP Device Host service (upnphost) must be running on the target - this service is present in default Windows installations but may be disabled in hardened or server-core environments. No special software configuration, elevated user role, or non-default setting is required beyond having a valid local logon. Exploitation is limited to the local host; no network-based trigger path exists, and the information leak does not cross into other system scopes (S:U). The primary limiting factors are the requirement for prior local access and the absence of integrity or code execution impact.

The CVSS base score of 5.5 (Medium) is consistent with the attack vector and impact profile: local access with low privileges required, confidentiality-only impact at high severity within the session scope. There is no integrity or availability impact, which limits the exploitability in practice to information gathering rather than direct system compromise. EPSS data is not provided; however, given no KEV listing and no public POC, real-world exploitation probability is assessed as low in the near term. The breadth of affected Windows versions - spanning every major Windows release currently in support (and several in extended/ESU support) - gives this issue a large potential attack surface in enterprise environments, even though the local-only prerequisite substantially limits exposure compared to network-exploitable vulnerabilities. The primary risk scenario is a low-privileged insider or post-exploitation attacker using this flaw to extract personal or sensitive information stored or cached by the UPnP service, potentially to facilitate lateral movement or privilege escalation through other means.

A low-privileged attacker who has obtained a local session on a Windows host - whether through credential theft, a remote code execution chain, or legitimate but restricted user access - queries or interacts with the UPnP Device Host service to retrieve private personal information (such as cached user identity data or device metadata) that the service fails to restrict to authorized principals. No public POC exists, so exploitation would require independent discovery of the specific service interface or API call that triggers the disclosure.