Windows Server 2012 EUVD-2026-22460

Local user account required. UPnP Device Host service must be running and accessible to non-administrative users. Successful exploitation requires ability to interact with vulnerable UPnP service components during specific race condition window.

This vulnerability presents moderate to high real-world risk despite the high CVSS base score of 7.8. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local attack vector requiring low-privileged authenticated access, but with low attack complexity and no user interaction needed once initial access is gained. The complete impact on confidentiality, integrity, and availability makes this a viable post-exploitation tool for attackers who have already established local foothold through phishing, social engineering, or other initial access vectors. However, the local-only attack vector significantly reduces the attack surface compared to remotely exploitable vulnerabilities. No public exploit identified at time of analysis and no CISA KEV listing, suggesting exploitation has not been observed in the wild. The EUVD data confirms patches are available across all affected versions with specific build numbers, reducing organizational risk for patched systems. The widespread deployment of Windows UPnP services in enterprise environments and the privilege escalation primitive make this a priority for patch deployment, though not an emergency requiring immediate out-of-band updates. Organizations should prioritize patching systems accessible to lower-trust users (workstations, jump boxes, multi-user servers) over isolated administrative systems.

An attacker with standard user credentials on a corporate Windows 10 workstation executes a specially crafted application