EUVD-2026-22593
GHSA-w3xc-48m6-6x2m
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Impact | CVSS 5.5 reflects moderate risk with local-only attack vector, low complexity, and authentication requirement (PR:L for standard user privileges). The vulnerability is confined to information disclosure (high confidentiality impact, no integrity or availability impact). The CVSS does not capture real-world severity, as the attacker must already possess local authenticated access-a significant barrier compared to network-based exploits. However, the attack is automatable (UI:N) and can be weaponized by any local user without administrative privileges, making it relevant in multi-user systems, shared workstations, or post-compromise lateral movement scenarios. SSVC perspective: this is a controlled disclosure (patch available), not actively exploited publicly, but the barrier to exploitation is low once access is gained. For organizations with tight local access controls, this is lower priority; for shared systems or environments where standard users are untrusted, this merits timely patching. No POC or KEV status suggests low immediate threat compared to unauthenticated network vulnerabilities, but the breadth of affected Windows versions (10+ major release variants) indicates widespread exposure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 14, 2026
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at tim
Earlier versions of this analysis (1)
Improper link resolution in Windows UPnP (upnp.dll) allows authenticated local attackers to disclose sensitive information through symlink following. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, and Windows Server 2012-2025. With local access and standard user privileges, an attacker can read files outside their normal access scope via crafted UPnP operations. Patch available from Microsoft; no public exploit code or active exploitation confirmed at time of analysis.
RemediationAI
Vendor-released patch available from Microsoft. Users should apply the latest security update for their Windows version via Windows Update, Systems Update for Business, or the Microsoft Update Catalog (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32212). For Windows 10 Version 1607, update to 10.0.14393.9060 or later; Windows 10 Version 1809, to 10.0.17763.8644 or later; Windows 10 Version 21H2, to 10.0.19044.7184 or later; Windows 10 Version 22H2, to 10.0.19045.7184 or later; Windows 11 Version 22H3, to 10.0.22631.6936 or later; Windows 11 Version 23H2, to 10.0.22631.6936 or later; Windows 11 Version 24H2, to 10.0.26100.32690 or later; Windows 11 Version 25H2, to 10.0.26200.8246 or later; Windows 11 Version 26H1, to 10.0.28000.1836 or later; Windows Server 2012, to 6.2.9200.26026 or later; Windows Server 2012 R2, to 6.3.9600
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 36 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Universal Plug and Play (UPnP) is a Windows service that enables device discovery and communication over local networks. The upnp.dll library handles UPnP protocol operations, including file access operations for configuration and device metadata. This vulnerability is a classic symlink-following flaw (CWE-59) where the library fails to validate that a file path does not resolve through symbolic links or junction points before accessing it. An authenticated user with local access can create symbolic links pointing to protected system files or sensitive user data, then trigger UPnP operations that follow these links without proper checks. The affected CPE strings span multiple Windows editions: Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), Windows Server 2012 through 2025 (including R2 and Server Core variants).
Know when Windows Server 2012 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Exploit-DB