CVE-2026-68830: Windows UPnP Information Disclosure Flaw

CVE-2026-68830 Overview

CVE-2026-68830 is a link following vulnerability [CWE-59] in the Windows Universal Plug and Play (UPnP) Device Host. An authorized local attacker can leverage improper link resolution before file access to disclose sensitive information on the affected system. The flaw requires local access and low privileges, with no user interaction needed to trigger the disclosure.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC) on September 8, 2026. The vulnerability affects the UPnP Device Host service component in Windows and is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
A local, authenticated attacker can read files accessible to the UPnP Device Host service context, potentially exposing sensitive system or user data.

Affected Products

Windows Universal Plug and Play (UPnP) Device Host component
Refer to the Microsoft Security Update Guide for the authoritative list of affected Windows builds
Systems with the UPnP Device Host service enabled

Discovery Timeline

2026-09-08 - CVE-2026-68830 published to NVD
2026-09-08 - Microsoft Security Update Guide entry released
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-68830

Vulnerability Analysis

The vulnerability resides in how the Windows UPnP Device Host resolves file paths before performing file access operations. When the service handles file references, it fails to properly validate whether a path component is a symbolic link, junction, or hard link before opening the target. An attacker with local access and low privileges can plant a crafted link that redirects the service to a file outside its intended scope.

Because the UPnP Device Host runs with elevated privileges relative to the attacker, the redirected file access returns contents the attacker could not otherwise read. The vulnerability impacts confidentiality only. Integrity and availability of the target system are not directly affected by successful exploitation.

Root Cause

The root cause is classified as [CWE-59: Improper Link Resolution Before File Access ('Link Following')]. The UPnP Device Host does not canonicalize or verify the final target of a file path before opening it, allowing symlink or junction abuse in a directory the attacker controls or can influence.

Attack Vector

Exploitation requires local access with low privileges (PR:L) and no user interaction. The attacker prepares a filesystem link that resolves to a sensitive file, then induces the UPnP Device Host to access the linked path. The service reads the target file under its own security context and returns or exposes the contents to the attacker. The Exploit Prediction Scoring System (EPSS) reports low near-term exploitation likelihood, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No public proof-of-concept code is available. See the Microsoft Security Update Guide for vendor-provided technical details.

Detection Methods for CVE-2026-68830

Indicators of Compromise

Unexpected symbolic links, junctions, or hard links created in directories accessed by the UPnP Device Host service (svchost.exe hosting upnphost)
File access events by the UPnP Device Host service targeting paths outside its expected working set
Local user processes creating reparse points shortly before UPnP-related file access events

Detection Strategies

Enable object access auditing on directories used by the UPnP Device Host and alert on reparse point creation by non-administrative users
Correlate Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) with subsequent access by the UPnP service process
Hunt for CreateSymbolicLink or junction creation activity from low-privileged user contexts on systems with UPnP enabled

Monitoring Recommendations

Monitor the state of the SSDPSRV and upnphost services and log configuration changes
Track file access patterns for the UPnP Device Host process across endpoints using EDR telemetry
Alert on read access to sensitive files (credential stores, configuration files) originating from service accounts that should not require them

How to Mitigate CVE-2026-68830

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-68830
Inventory endpoints with the UPnP Device Host service enabled and prioritize patching for multi-user or shared systems
Restrict local logon rights on affected hosts to reduce the pool of potential attackers

Patch Information

Microsoft has released an official security update addressing CVE-2026-68830. Consult the Microsoft Security Update Guide for the applicable knowledge base articles, build numbers, and download packages for each supported Windows release.

Workarounds

Disable the UPnP Device Host service (upnphost) on systems that do not require UPnP functionality
Remove the SSDP Discovery service (SSDPSRV) dependency where UPnP is not needed for business operations
Apply strict NTFS permissions on directories accessed by the UPnP service to prevent low-privileged users from creating reparse points

bash

# Disable the UPnP Device Host service on Windows
sc.exe config upnphost start= disabled
sc.exe stop upnphost

# Disable SSDP Discovery (UPnP dependency) if not required
sc.exe config SSDPSRV start= disabled
sc.exe stop SSDPSRV