CVE-2026-32214: Windows 10 1607 Information Disclosure Flaw

CVE-2026-32214 Overview

CVE-2026-32214 is an improper access control vulnerability in the Windows Universal Plug and Play (UPnP) component upnp.dll. The flaw allows an authenticated local attacker to disclose sensitive information from an affected Windows system. Microsoft assigned the issue CWE-284: Improper Access Control and rated it MEDIUM severity. The vulnerability impacts a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions through 2025. No public exploit code or in-the-wild exploitation has been reported as of disclosure.

Critical Impact

An authorized local attacker can read information they should not have permission to access through the UPnP service, breaching confidentiality on the targeted host.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2) — x86, x64, ARM64
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) — x64, ARM64
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-04-14 - CVE-2026-32214 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-32214

Vulnerability Analysis

The vulnerability resides in upnp.dll, the Windows library that implements Universal Plug and Play discovery and control services. UPnP enables devices and applications on a local system or network to advertise capabilities and negotiate services without manual configuration. In affected builds, the component does not consistently enforce access controls on certain operations or resources it exposes to local callers.

A local user with low privileges can interact with the UPnP interface and retrieve information that the access policy should restrict. The disclosed data is limited to confidentiality impact, with no integrity or availability consequences per the CVSS vector. Microsoft mapped the weakness to CWE-284, indicating the defect is a missing or incorrect authorization check rather than a memory safety bug.

The EPSS probability is 0.039%, reflecting low predicted exploitation activity at the time of analysis.

Root Cause

The root cause is an authorization gap in upnp.dll where the service trusts a caller's session without validating that the principal is permitted to read the targeted resource. Because UPnP runs with elevated context relative to a standard user, an attacker can leverage the trust boundary to bypass intended restrictions on information exposed by the service.

Attack Vector

Exploitation requires local access and valid credentials on the target system. The attacker authenticates, then issues crafted requests to the UPnP component. No user interaction is required, and attack complexity is low. The vulnerability cannot be triggered remotely over a network, which constrains exposure to scenarios where an adversary has already established a foothold, such as through phishing, stolen credentials, or shared multi-user systems.

The vulnerability is described as an authorization flaw. No verified proof-of-concept code is publicly available. Refer to the Microsoft Security Update Guide for CVE-2026-32214 for vendor-supplied technical details.

Detection Methods for CVE-2026-32214

Indicators of Compromise

• Unexpected process activity from svchost.exe instances hosting the SSDP Discovery (SSDPSRV) or UPnP Device Host (upnphost) services initiated by non-administrative users.
• Local user sessions querying UPnP interfaces or upnp.dll exports outside of normal application workflows.
• Atypical access patterns to UPnP-related registry keys under HKLM\SOFTWARE\Microsoft\UPnP.

Detection Strategies

• Monitor process lineage for standard user accounts spawning utilities that interact with UPnP COM interfaces or DCOM endpoints.
• Correlate authentication events with subsequent enumeration of local services to identify post-logon information-gathering behavior.
• Establish behavioral baselines for UPnP service consumers and alert on deviation by non-typical callers.

Monitoring Recommendations

• Enable Windows Security and Sysmon logging for process creation (Event ID 4688/1) and DLL load events targeting upnp.dll.
• Track local privilege use and object access events on UPnP service endpoints across multi-user systems and Remote Desktop Session Hosts.
• Forward endpoint telemetry to a centralized analytics platform for cross-host correlation and retention.

How to Mitigate CVE-2026-32214

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-32214 to all affected Windows client and server systems.
• Prioritize patching on shared, multi-user, and Remote Desktop hosts where local authenticated access is broader.
• Audit local user and group memberships to enforce least privilege and reduce the population of accounts able to exploit the flaw.

Patch Information

Microsoft has released security updates addressing CVE-2026-32214 across all supported Windows 10, Windows 11, and Windows Server releases listed in the affected products section. Install the cumulative update appropriate for each operating system build through Windows Update, WSUS, or the Microsoft Update Catalog. Validate deployment with patch compliance reporting after rollout.

Workarounds

• Disable the SSDPSRV (SSDP Discovery) and upnphost (UPnP Device Host) services on systems that do not require UPnP functionality, after testing for application dependencies.
• Restrict interactive and remote logon rights to trusted accounts using Group Policy User Rights Assignment settings.
• Apply application control policies to limit which binaries can interact with UPnP interfaces on sensitive hosts.

# Disable UPnP-related services where not required (run as Administrator)
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV
sc.exe config upnphost start= disabled
sc.exe stop upnphost