CVE-2026-69351
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
An exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Risk Assessment
The risk includes potential disclosure of private information, which could violate user privacy and data security.
Recommendation
Apply security patches for UPnP Device Host and restrict access to UPnP services.
Other vulnerabilities in Windows UPnP Device Host
See all- CVE-2026-68830Medium
A vulnerability in the Windows Universal Plug and Play (UPnP) Device Host involves improper link resolution before file access (link following). An authorized attacker could exploit this to disclose information locally.
- CVE-2021-26899High
Elevation of privilege vulnerability in Windows UPnP Device Host. An attacker could exploit it to gain elevated privileges on the system.
Original NVD description (English source)
Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS