Windows UPnP EUVD-2026-43797

Exploitation requires the attacker to hold at least a standard (low-privileged) local user account on the target Windows system - matching the CVSS PR:L rating. The UPnP service (upnphost / SSDP Discovery) must be running; it is enabled by default on Windows 10 and 11 client editions and optionally on server editions. The attacker must be able to create NTFS symbolic links or junction points at a path the UPnP service accesses; directory junctions can be created by standard users without elevated privileges, while file symbolic links typically require SeCreateSymbolicLinkPrivilege or Developer Mode to be enabled. No network access to the target is required (AV:L), no user interaction is needed (UI:N), and no special application state needs to be triggered beyond the UPnP service's normal file resolution. Exploitation is limited to confidentiality impact only - no write or denial-of-service primitive is exposed.

Real-world risk is moderate-to-low despite the C:H confidentiality rating. The CVSS vector (AV:L/AC:L/PR:L) limits attack surface to users who already hold local interactive or remote desktop access - a meaningful prerequisite that substantially narrows the threat population. EPSS at 0.27% (19th percentile) places this well below typical exploitation thresholds. CISA SSVC confirms exploitation status as 'none', marks the flaw as not automatable, and rates technical impact as partial - consistent with an information-disclosure-only outcome (I:N, A:N in the vector). No KEV listing and no public POC further suppress urgency. The highest realistic concern is post-compromise lateral movement: an attacker who already holds a foothold may use this to read sensitive files (e.g., credential stores, configuration secrets) that their current privilege level would otherwise block. Treat as a patch-cycle priority rather than an emergency response item for most environments.

A standard-privilege Windows user logs in locally or via Remote Desktop, identifies a directory path that the UPnP service reads during normal operation, and replaces or populates that path with an NTFS junction or symbolic link pointing to a sensitive file such as a service account credential cache or application configuration containing secrets. When the UPnP service next performs its file access, it follows the attacker-placed link without validation and reads the sensitive file's contents, which the attacker can subsequently retrieve. No public POC exists at time of analysis, but the technique is well-understood within the Windows symlink/junction exploitation class.