CVE-2026-49180: Windows 10 1607 Information Disclosure

CVE-2026-49180 Overview

CVE-2026-49180 is an information disclosure vulnerability in the Windows Universal Plug and Play (UPnP) component upnp.dll. The flaw stems from improper link resolution before file access, classified under [CWE-59]. An authenticated local attacker can leverage symbolic or hard links to force the UPnP service into reading files the attacker would otherwise be unable to access, disclosing their contents.

Microsoft published the advisory on July 14, 2026, and the issue affects supported Windows client and server editions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Critical Impact
A local authenticated attacker can abuse link following in upnp.dll to disclose confidential file contents that require higher privileges, enabling further compromise of the host.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - Microsoft releases security advisory for CVE-2026-49180
2026-07-14 - CVE-2026-49180 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49180

Vulnerability Analysis

The Universal Plug and Play service implemented in upnp.dll performs file operations without validating whether the target path is a symbolic link, junction, or hard link. When the service opens a file on behalf of a request, it dereferences the link and reads the linked target under the service's security context. Because the UPnP service runs with higher privileges than a standard local user, the attacker inherits the ability to read files they could not open directly.

Exploitation requires local access and low-privileged authentication. There is no user interaction requirement, and the scope remains unchanged. The impact is limited to confidentiality: integrity and availability are not affected. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is a missing check between the time upnp.dll resolves a user-supplied path and the time it opens the corresponding file. The component follows reparse points without verifying that the final target resides within an expected directory or is owned by the requesting user. This is a classic link-following weakness ([CWE-59]) where trusted code performs file I/O on paths influenced by an untrusted actor.

Attack Vector

An attacker with a local, authenticated session plants a symbolic link or NTFS junction in a directory writable by their account. The attacker then triggers the UPnP service to access that path. Because upnp.dll opens the link's target under the service's token, the file contents are returned or exposed through the service's normal output channels. The attacker reads the disclosed data and can iterate against other sensitive targets such as configuration files, credential stores, or logs. No verified exploit code is publicly available for this vulnerability. Refer to the Microsoft Security Update Guide for CVE-2026-49180 for authoritative technical details.

Detection Methods for CVE-2026-49180

Indicators of Compromise

Creation of symbolic links, junctions, or hard links in directories writable by standard users that reference sensitive system paths such as C:\Windows\System32\config\ or user profile locations.
Access events by the UPnP host service (svchost.exe hosting upnphost) reading files outside its typical working set.
mklink command execution or CreateSymbolicLink API calls from non-administrative processes.

Detection Strategies

Monitor Windows Security event ID 4663 for file access by the UPnP service targeting files unrelated to device discovery or media sharing.
Alert on the SeCreateSymbolicLinkPrivilege being exercised by non-administrative accounts, which is uncommon on default Windows installations.
Correlate reparse point creation with subsequent reads by the upnphost service within short time windows to identify link-following abuse.

Monitoring Recommendations

Enable object access auditing on directories containing sensitive configuration and credential material.
Ingest Sysmon events 11 (FileCreate) and 15 (FileCreateStreamHash) alongside UPnP service telemetry into a centralized analytics platform for correlation.
Track UPnP service start events on systems where the service should be disabled, as unexpected activation raises the attack surface for this issue.

How to Mitigate CVE-2026-49180

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-49180 to all affected Windows client and server systems.
Inventory systems that have the SSDP Discovery and UPnP Device Host services enabled, prioritizing patch deployment on those hosts.
Restrict local logon rights on servers and workstations that expose UPnP functionality to reduce the population of accounts able to exploit the flaw.

Patch Information

Microsoft has issued cumulative security updates addressing CVE-2026-49180 across all supported Windows client and server versions. Consult the Microsoft Security Update Guide for the specific KB numbers matching each build. Install the update through Windows Update, WSUS, Microsoft Update Catalog, or your patch management tooling.

Workarounds

Disable the UPnP Device Host and SSDP Discovery services on systems that do not require them by setting their startup type to Disabled and stopping the running services.
Remove the SeCreateSymbolicLinkPrivilege from standard user groups where symbolic link creation is not required for business workflows.
Apply Attack Surface Reduction and least-privilege policies so that low-privileged accounts cannot write to directories referenced by service-side file operations.

bash

# Disable the UPnP-related services on a Windows host
sc.exe config upnphost start= disabled
sc.exe stop upnphost
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV