CVE-2026-32077

What it actually does

CVE-2026-32077 is a local privilege-escalation vulnerability in the Windows Universal Plug and Play Device Host component. An attacker who already has authenticated local code execution can trigger an untrusted pointer dereference in the UPnP Device Host service path, potentially causing privileged memory access and execution in a higher-privileged security context. Successful exploitation can allow the attacker to gain elevated privileges on the affected Windows host, with high confidentiality, integrity, and availability impact. The flaw is not remotely exploitable by itself and requires low-privileged local access, but it has low attack complexity and does not require user interaction.

Why it matters to the business

If exploited, this vulnerability can turn an initial low-privilege foothold into full control of a workstation or server, enabling credential theft, security tool tampering, lateral movement, data access, or deployment of additional malware. Because the affected product set spans many supported Windows client and server versions, exposure can be broad in mixed Windows estates. It is not currently listed in CISA KEV, has no known ransomware association, no known public exploit maturity, and a low EPSS score, so it is lower urgency than actively exploited Windows privilege-escalation flaws; however, privilege-escalation bugs are commonly chained with phishing, stolen credentials, web-shells, or remote code execution vulnerabilities.

How an attack unfolds

An attacker first obtains local authenticated access to a vulnerable Windows system, such as through malware execution, compromised user credentials, an exposed service account, or another vulnerability. From that foothold, the attacker runs a local exploit that interacts with the Windows UPnP Device Host functionality and supplies crafted input that causes the service or related code path to dereference an attacker-influenced pointer. If exploitation succeeds, code execution or security context manipulation occurs with elevated privileges. The attacker can then create or modify administrator-level access, dump credentials, disable defenses, install persistence, access protected data, or use the host as a staging point for lateral movement. No public exploitation or named threat actor activity is currently reported for this CVE, so defenders should focus on patch compliance and on behavioral evidence of local privilege escalation around UPnP Device Host activity.

How to fix it

Apply the Microsoft security update that remediates CVE-2026-32077 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no per-product fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Configuration Manager, or the Microsoft Update Catalog to deploy the applicable April 2026 or later cumulative security update for each supported platform. Prioritize systems where low-privileged users can log on interactively, multi-user servers, jump hosts, VDI, developer workstations, and internet-facing servers where an initial compromise could be chained with local privilege escalation. If immediate patching is not possible, reduce risk by limiting local logon rights, enforcing least privilege, hardening service account usage, monitoring for privilege escalation behavior, and disabling the UPnP Device Host service only where business functionality has been tested and confirmed not to depend on it.

How to confirm the fix worked

Confirm that each affected host has installed the Microsoft cumulative update or security-only update that includes the fix for CVE-2026-32077. Validate through centralized patch inventory, Windows Update history, PowerShell queries such as Get-HotFix, enterprise vulnerability scanners, or endpoint management compliance reports. Check that the OS build and installed KB level correspond to Microsoft’s fixed baseline for the relevant Windows release. For systems where UPnP Device Host was temporarily disabled as a mitigation, confirm the service state is intentional and documented. To detect remaining exposure, scan for affected Windows versions that have not received April 2026 or later security updates and prioritize any machines allowing local or remote interactive logon by non-administrators.

Typical attack path

1. Gain initial low-privileged access to an affected Windows workstation or server.
2. Confirm the host is running a vulnerable Windows build and that the UPnP Device Host component or related service path is present.
3. Execute a local exploit that triggers the untrusted pointer dereference in the UPnP Device Host code path.
4. Obtain elevated privileges on the local system if exploitation is successful.
5. Use elevated access to dump credentials, modify security controls, create persistence, or access sensitive files.
6. Move laterally or deploy follow-on tooling using the newly elevated privileges.

How to detect it

There are no public, vulnerability-specific exploit indicators for this issue at this time. To determine whether exploitation may have occurred, review Windows security, system, application, service control manager, Windows Error Reporting, EDR, and Sysmon telemetry for suspicious activity involving the UPnP Device Host service or its hosting svchost.exe process. Look for crashes or restarts of UPnP Device Host followed closely by privilege changes, new local administrator membership, new services, scheduled tasks, credential dumping tools, defense evasion, or unexpected child processes. Useful Windows events include Security 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624/4627 for logon context, 4732/4728 for privileged group membership changes, 7045 for new service installation, 4698 for scheduled task creation, System 7031/7034 for service termination, and Application 1000/1001 for application crash or Windows Error Reporting records. In EDR, investigate svchost.exe instances hosting UPnP Device Host that exhibit abnormal memory access, crashes, exploit-prevention alerts, unexpected module loads, or child-process creation. Because this is a local privilege-escalation vulnerability, the strongest signs of compromise will usually be post-exploitation behavior rather than a unique network signature.

• UPnP Device Host
• upnphost
• upnphost.dll
• %SystemRoot%\System32\upnphost.dll
• HKLM\SYSTEM\CurrentControlSet\Services\upnphost
• Faulting module name: upnphost.dll
• The UPnP Device Host service terminated unexpectedly
• svchost.exe -k LocalServiceAndNoImpersonation
• Event ID 7031
• Event ID 7034
• Event ID 1000
• Event ID 1001

What your security team should do

• Deploy the applicable Microsoft security update across affected Windows client and server versions, prioritizing multi-user systems, privileged access workstations, servers, and high-value endpoints.
• Use vulnerability management tooling to identify Windows 10, Windows 11, and Windows Server assets missing the April 2026 or later cumulative update that contains the fix.
• Monitor for local privilege-escalation behavior, especially new administrator group membership, suspicious token elevation, credential dumping, or security control tampering following low-privileged user activity.
• Review whether the UPnP Device Host service is required on servers and managed endpoints; disable it only where compatibility testing confirms no business impact.
• Restrict local logon and remote interactive logon permissions to the minimum required users and service accounts.
• Ensure endpoint detection and response coverage is active on Windows systems so suspicious post-exploitation behavior is captured even if the initial exploit has limited forensic artifacts.
• Because this is not currently KEV-listed and has low EPSS, treat it as routine-to-expedited patching rather than emergency response unless local exploitation signals appear in telemetry.