CVE-2026-68830
Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- CWE
- CWE-59, CWE-269
- Published
- 2026-09-08
- Last modified
- 2026-09-09
Affected products
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Microsoft Windows 10 Version 22H2
- Microsoft Windows 11 version 23H2
- Microsoft Windows 11 Version 23H2
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
Weakness type
Related vulnerabilities
- CVE-2026-87766 — Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup
- CVE-2026-78622 — Improper Link Resolution in Okta Verify for Windows Uninstaller Data Removal
- CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability
- CVE-2026-69425 — Windows NTFS Tampering Vulnerability
- CVE-2026-69289 — Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-83999 — Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability
- CVE-2026-70563 — Windows Shell Spoofing Vulnerability
- CVE-2026-69771 — Windows Container Manager Service Security Feature Bypass Vulnerability