CVE-2026-68830 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability

Api.Msrc.Microsoft • September 8, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Sep 8, 2026

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CWE-269: Improper Privilege Management

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

What type of information could be disclosed by this vulnerability?

The type of information that could be disclosed if an attacker successfully exploited this vulnerability includes unauthorized access to the file system, specifically file path information.

Doug Lorenzen with AHEAD

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Information Disclosure Vulnerabilities in Windows UPnP Device Host On September 8, 2026, Microsoft disclosed two critical vulnerabilities in the Windows Universal Plug and Play (UPnP) Device Host, identified as CVE-2026-68830 and CVE-2026-69351. Both vulnerabilities allow authorized attackers to disclose sensitive information locally, specifically unauthorized access to the file system and file path information. The vulnerabilities stem from improper link resolution and privilege management issues. They affect all versions of Windows that support UPnP. Microsoft has released advisories detailing the vulnerabilities and their potential impact. No active exploitation has been reported as of the publication date. Organizations using affected systems are advised to monitor for updates and apply patches as they become available. 2 sources 40

Extracted Entities

CVE-2026-68830 Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

Platforms (1)

Vulnerabilities (1)