CVE-2026-69351

Analyzed Analyzed - Analysis Complete

Exposure of Private Information in Windows UPnP Device Host

Publication date: 2026-09-08

Last updated on: 2026-09-24

Assigner: Microsoft Corporation

Description

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-24

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-69351

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	windows_universal_plug_and_play	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Windows Universal Plug and Play (UPnP) Device Host exposing private personal information to unauthorized actors. An authorized attacker could locally access sensitive data due to this exposure.

Impact Analysis

An attacker with local access could view private personal information, leading to potential privacy breaches or identity theft. The impact is limited to local disclosure as remote exploitation is not indicated.

Compliance Impact

This vulnerability could violate privacy regulations like GDPR or HIPAA by exposing personal data to unauthorized parties. Organizations may face compliance penalties if such breaches occur due to inadequate safeguards.

Mitigation Strategies

Disable the Windows Universal Plug and Play (UPnP) Device Host service to prevent unauthorized information disclosure. Check service status with 'sc query upnphost' and stop it using 'sc stop upnphost' followed by 'sc config upnphost start= disabled'.

Hi! I’m here to help you understand CVE-2026-69351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70