Improper Link Resolution in Windows UPnP Device Host

Publication date: 2026-09-08

Last updated on: 2026-09-24

Assigner: Microsoft Corporation

Description

Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-24

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-68830

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_universal_plug_and_play_device_host	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper link resolution issue in Windows Universal Plug and Play (UPnP) Device Host. It allows an authorized attacker to follow symbolic links to access files they should not be able to, potentially leading to unauthorized information disclosure on the local system.

Impact Analysis

If exploited, this vulnerability could allow an attacker with local access to read sensitive files on your system. This might include personal data, system configurations, or other confidential information, depending on what files are accessible through the link following mechanism.

Mitigation Strategies

Disable the Windows Universal Plug and Play (UPnP) Device Host service if not required. Update Windows systems with the latest security patches from Microsoft to address the improper link resolution issue.

Hi! I’m here to help you understand CVE-2026-68830. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70