CVE-2026-68830
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in the Windows Universal Plug and Play (UPnP) Device Host involves improper link resolution before file access (link following). An authorized attacker could exploit this to disclose information locally.
Risk Assessment
An attacker with local access could gain access to files they should not have access to, potentially leading to sensitive data leakage.
Recommendation
Install the latest Windows security patches. Restrict access to UPnP services to trusted networks only.
Other vulnerabilities in Windows UPnP Device Host
See all- CVE-2026-69351Medium
An exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
- CVE-2021-26899High
Elevation of privilege vulnerability in Windows UPnP Device Host. An attacker could exploit it to gain elevated privileges on the system.
Original NVD description (English source)
Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS