CVE-2026-32212: UPnP Information Disclosure Vulnerability

CVE-2026-32212 Overview

CVE-2026-32212 is a link following vulnerability (CWE-59) in the Windows Universal Plug and Play service (upnp.dll). This vulnerability allows an authorized local attacker to exploit improper link resolution before file access, resulting in the disclosure of sensitive information. The flaw occurs when the UPnP service follows symbolic links without proper validation, potentially exposing protected system files or user data to unauthorized access.

Critical Impact

Local information disclosure through symlink exploitation in Windows UPnP service affecting system confidentiality.

Affected Products

• Microsoft Windows (Universal Plug and Play Service - upnp.dll)

Discovery Timeline

• April 14, 2026 - CVE-2026-32212 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32212

Vulnerability Analysis

This vulnerability represents a classic Time-of-Check Time-of-Use (TOCTOU) race condition combined with improper symlink handling in the Windows UPnP service. The vulnerability allows an authenticated local user to manipulate symbolic links in a way that causes the UPnP service to access files outside its intended scope.

The attack exploits the UPnP service's failure to properly resolve and validate file paths before accessing them. When the service processes certain file operations, it does not adequately verify whether a path has been replaced with a symbolic link pointing to a sensitive location. This allows attackers with local access to craft symlinks that redirect file operations to protected system files or user data.

The local attack vector requires the attacker to have an existing authenticated session on the target system. Once established, the attacker can leverage this vulnerability to read sensitive configuration files, cached credentials, or other protected data that the UPnP service has elevated privileges to access.

Root Cause

The root cause of CVE-2026-32212 lies in the UPnP service's failure to implement proper symlink-safe file access operations. The upnp.dll component does not use appropriate Windows APIs or flags that would prevent following symbolic links when accessing files. Specifically, the service fails to:

1. Verify the final resolved path of file operations before access
2. Use FILE_FLAG_OPEN_REPARSE_POINT or similar protections when opening files
3. Implement proper access control checks on the resolved path rather than the original path

This allows attackers to create junction points or symbolic links that redirect the service's file operations to arbitrary locations on the filesystem.

Attack Vector

The attack requires local access with low privileges. An attacker would:

1. Identify a predictable file path accessed by the UPnP service
2. Replace that path with a symbolic link pointing to a sensitive target file
3. Trigger the UPnP service to access the manipulated path
4. The service follows the symlink and discloses the contents of the target file

The vulnerability mechanism exploits the race condition between when the UPnP service checks file permissions and when it actually accesses the file contents. During this window, an attacker can substitute the legitimate path with a symbolic link, causing the service to read from an unintended location with its elevated privileges.

For detailed technical information about this vulnerability, refer to the Microsoft CVE-2026-32212 Advisory.

Detection Methods for CVE-2026-32212

Indicators of Compromise

• Unusual symbolic link creation in directories accessed by the UPnP service
• Unexpected file access patterns from svchost.exe processes hosting the UPnP service
• Creation of junction points or symbolic links pointing to sensitive system files like SAM, SYSTEM, or credential stores
• Anomalous file read operations by the UPnP service on files outside its normal working directories

Detection Strategies

• Monitor for symbolic link and junction point creation using Windows Security Event logging (Event ID 4663 with object type of symbolic link)
• Implement file integrity monitoring on directories commonly targeted by symlink attacks
• Use SentinelOne's behavioral AI to detect suspicious file access patterns from Windows services
• Deploy endpoint detection rules to identify TOCTOU race condition exploitation attempts

Monitoring Recommendations

• Enable verbose logging for the UPnP service and monitor for unusual file access attempts
• Configure Windows Defender Exploit Guard to alert on symlink-based attacks
• Monitor process behavior for svchost.exe instances hosting upnp.dll accessing unexpected file paths
• Implement real-time alerting on creation of symbolic links in system directories

How to Mitigate CVE-2026-32212

Immediate Actions Required

• Apply the latest Windows security updates from Microsoft addressing CVE-2026-32212
• If the UPnP service is not required, consider disabling it via Services management console
• Restrict user permissions to create symbolic links using Group Policy (User Rights Assignment: Create symbolic links)
• Audit and monitor systems for signs of exploitation attempts

Patch Information

Microsoft has released a security update to address this vulnerability. Refer to the Microsoft CVE-2026-32212 Advisory for specific patch details and download links. Organizations should prioritize applying this patch on systems where the UPnP service is actively used.

Workarounds

• Disable the UPnP Device Host service (upnphost) if not required for business operations
• Remove the "Create symbolic links" privilege from standard users via Group Policy
• Implement application whitelisting to restrict which processes can create symbolic links
• Use Windows Defender Attack Surface Reduction rules to limit symlink-based attack vectors

# Disable UPnP Device Host Service (PowerShell)
Stop-Service -Name "upnphost" -Force
Set-Service -Name "upnphost" -StartupType Disabled

# Verify service is disabled
Get-Service -Name "upnphost" | Select-Object Name, Status, StartType