EUVD-2026-73456
GHSA-99p7-g3fw-3f6v
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local attack requiring low-privilege session; confidentiality-only impact as no write or denial-of-service capability is described.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
AnalysisAI
Information disclosure in Windows Universal Plug and Play (UPnP) Device Host allows a local authenticated attacker to access private personal information they are not authorized to view. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated session with at least low-privilege rights (PR:L per CVSS); remote unauthenticated exploitation is not possible with this attack vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.5 (Medium) is consistent with the attack vector and impact profile: local access with low privileges required, confidentiality-only impact at high severity within the session scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security updates corresponding to the installed Windows version; patched build numbers are listed in the affected products section above and the full update guidance is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69351. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today