CVE-2026-69351
Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.5
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
- EPSS probability
- 0.47%
- CWE
- CWE-359
- Published
- 2026-09-08
- Last modified
- 2026-09-10
Affected products
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- Microsoft Windows 10 Version 21H2
- Microsoft Windows 10 Version 22H2
- Microsoft Windows 11 version 23H2
- Microsoft Windows 11 Version 23H2
- Microsoft Windows 11 Version 24H2
- Microsoft Windows 11 Version 25H2
Weakness type
Related vulnerabilities
- CVE-2026-73008 — Windows Biometric Service Information Disclosure Vulnerability
- CVE-2026-21827 — HCL Connections is vulnerable to an information disclosure vulnerability
- CVE-2026-53497 — CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)
- CVE-2026-58510 — GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private
- CVE-2026-48048 — XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests
- CVE-2026-24078 — Exposure of Private Personal Information to an Unauthorized Actor in Data Modem
- CVE-2026-55496 — Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate
- CVE-2026-56171 — Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability