Skip to main content

Windows Server 2012 EUVDEUVD-2026-22595

| CVE-2026-32214 MEDIUM
Improper Access Control (CWE-284)
2026-04-14 microsoft GHSA-g4ph-p8r8-x8fc
Authentication Bypass Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 22H3 Windows 11 Version 23H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2022 23H2 Edition Server Core Installation Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation
5.5
CVSS 3.1 · NVD
Temporal: 4.8
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CIRCL (temporal)
4.8 MEDIUM
cvss

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

5
Analysis Generated
Apr 14, 2026 - 19:43 vuln.today
EUVD ID Assigned
Apr 14, 2026 - 17:46 euvd
EUVD-2026-22595
Analysis Generated
Apr 14, 2026 - 17:46 vuln.today
Patch released
Apr 14, 2026 - 17:46 nvd
Patch available
CVE Published
Apr 14, 2026 - 16:58 nvd
MEDIUM 5.5

DescriptionCVE.org

Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

AnalysisAI

Improper access control in Universal Plug and Play (upnp.dll) on Windows allows authenticated local attackers to disclose sensitive information without user interaction. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2012-2025. Microsoft has released patches available through their security update guide; no public exploit code or active exploitation has been reported at time of analysis.

Technical ContextAI

Universal Plug and Play (UPnP) is a network protocol implemented via upnp.dll on Windows systems that enables automatic device discovery and configuration. The vulnerability stems from improper access control in this library, categorized under CWE-284 (Improper Access Control), which occurs when the application does not properly enforce restrictions on who can access specific resources or functionality. The flaw allows a local authenticated user with low privileges (PR:L per CVSS vector) to bypass intended access restrictions and read sensitive information that should be restricted to higher privilege levels or specific users. This is a common pattern in privilege escalation or information disclosure attacks targeting system libraries where permission checks are insufficiently enforced at the API or resource level.

RemediationAI

Vendor-released patch: Microsoft has released security updates addressing this vulnerability across all affected Windows versions. Administrators should apply the latest cumulative updates or monthly security updates from the Microsoft Security Response Center (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32214) corresponding to each affected Windows version. For Windows 10, ensure installation of updates that bring build numbers to or above: 1607 (14393.9060), 1809 (17763.8644), 21H2 (19044.7184), and 22H2 (19045.7184). For Windows 11, apply updates to reach: 22H3 (22631.6936), 23H2 (22631.6936), 24H2 (26100.32690), 25H2 (26200.8246), and 26H1 (28000.1836). For Windows Server versions, update to: 2012/R2 (9600.23132), 2016 (14393.9060), 2019 (17763.8644), 2022 (20348.5020 or 23H2 25398.2274), and 2025 (26100.32690). As an interim mitigation prior to patching, restrict local user account privileges and audit UPnP service access controls where feasible. Enable Windows Update to ensure automatic patching of future security issues.

More in Windows Server 2012

View all
CVE-2021-40444 HIGH POC
8.8 Sep 15

Windows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
CVE-2021-34527 HIGH POC
8.8 Jul 02

<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
CVE-2017-0199 HIGH POC
7.8 Apr 12

Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
CVE-2022-30190 HIGH POC
7.8 Jun 01

Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
CVE-2017-0147 HIGH POC
7.5 Mar 17

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
CVE-2018-8174 HIGH POC
7.5 May 09

The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
CVE-2021-1675 HIGH POC
7.8 Jun 08

Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
CVE-2016-7255 HIGH POC
7.8 Nov 10

The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited

CVE-2023-36884 HIGH POC
7.5 Jul 11

Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2019-1458 HIGH POC
7.8 Dec 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2018-8453 HIGH POC
7.8 Oct 10

An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in

CVE-2021-42278 HIGH POC
7.5 Nov 10

Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-22595 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy