CVE-2026-49180

What it actually does

This is a local Windows link-following flaw in the Universal Plug and Play component, upnp.dll. An authenticated local attacker can manipulate filesystem links such as symbolic links, junctions, mount points, or other reparse points so that a UPnP-related file operation resolves to an unintended target. Depending on the vulnerable code path and privileges of the UPnP operation, this can allow tampering with files the attacker should not be able to modify, and may also expose local information through unintended file access. The issue requires local access and low privileges; it is not a direct remote network exploit.

Why it matters to the business

Successful exploitation can let a low-privileged local user undermine Windows file protections, potentially modifying protected operating-system or application files and weakening host integrity. The main operational risk is post-compromise privilege advancement or persistence on workstations and servers where an attacker already has a foothold. The CVSS score is moderate, EPSS is currently low, it is not listed in CISA KEV, and no mature public exploitation is indicated, so urgency is lower than for remotely exploitable or actively exploited Windows vulnerabilities, but it should still be addressed through normal Windows patch management.

How an attack unfolds

An attacker first obtains the ability to run code or commands as a low-privileged local user on an affected Windows system. The attacker then identifies a UPnP component file operation that can be influenced from a writable location or attacker-controlled path. They create a filesystem redirection object, such as a symbolic link, junction, or mount point, that appears to the vulnerable component as an expected file path but actually resolves to a protected target. When the UPnP service or library performs the file access without safely resolving and validating the final target, the operation is redirected. If the redirected operation is privileged or trusted, the attacker can affect a file or location outside their normal permissions. In a broader intrusion, this type of bug is most useful after initial access, where it can support local privilege escalation, tampering, or persistence rather than initial compromise.

How to fix it

Apply the relevant Microsoft security update for affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. No product-specific fixed build numbers were provided in the input, so use the latest cumulative update or security-only update applicable to each supported Windows release. Prioritize systems that allow interactive logon, shared-user access, developer workloads, Remote Desktop access, or other paths where low-privileged users can execute code. If immediate patching is not possible, reduce exposure by limiting local interactive access, restricting non-administrative ability to create symbolic links where feasible, hardening writable directories, and disabling UPnP-related services only where operationally safe and validated.

How to confirm the fix worked

Confirm the applicable Microsoft security update is installed on each affected Windows version through Windows Update, WSUS, Microsoft Configuration Manager, Intune, or vulnerability management inventory. Verify that upnp.dll has been updated to the version delivered by the relevant monthly cumulative update for the operating system build. Use authenticated vulnerability scans or patch compliance reports to confirm the CVE is no longer reported. For compensating controls, verify that non-administrative users cannot create symbolic links unless explicitly required, and review service configuration to ensure unnecessary UPnP services are disabled only where business functionality permits.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Identify a writable path or controllable file operation used by the Windows UPnP component.
3. Create a symbolic link, junction, mount point, or other reparse point that redirects the operation to a protected file or directory.
4. Trigger the UPnP-related code path so upnp.dll follows the attacker-controlled link.
5. Cause the privileged or trusted file operation to affect the unintended target.
6. Use the resulting file modification or information access to support privilege escalation, persistence, or further host compromise.

How to detect it

There are no widely reported public exploit indicators for this vulnerability, so detection should focus on behavioral evidence of local link-abuse and suspicious UPnP-related file activity. Review Windows Security logs, Sysmon logs, EDR telemetry, and filesystem auditing for low-privileged users creating symbolic links, junctions, hardlinks, mount points, or other reparse points in writable locations shortly before privileged file writes or unusual UPnP service activity. Useful data sources include Sysmon FileCreate, FileCreateStreamHash, Process Create, and Registry events; Windows Security events for process creation if command-line auditing is enabled; object access auditing on sensitive files and directories; and EDR file lineage showing svchost.exe or UPnP-related components interacting with unexpected paths. Investigate cases where svchost.exe hosting UPnP-related services accesses files outside expected Windows service directories, especially when preceded by commands such as mklink, fsutil hardlink, PowerShell symbolic-link creation, or suspicious directory junction creation. Also look for post-exploitation signs such as newly modified protected files, unexpected service configuration changes, unusual scheduled tasks, new autostart entries, or privilege escalation activity after local user execution.

What your security team should do

• Patch affected Windows endpoints and servers through the normal monthly security update process, prioritizing multi-user systems, jump hosts, RDS hosts, developer machines, and internet-facing servers where local post-exploitation matters most.
• Inventory affected Windows 10, Windows 11, and Windows Server releases and validate that each is on a supported servicing channel receiving current cumulative updates.
• Harden local privilege escalation paths by limiting interactive logon rights, reducing local administrator membership, and restricting SeCreateSymbolicLinkPrivilege to trusted administrators or approved developer roles.
• Monitor for suspicious creation of symbolic links, junctions, hardlinks, and mount points by low-privileged users in writable directories followed by privileged service activity.
• Because this is not currently KEV-listed and has low EPSS, treat it as important hygiene rather than emergency response unless local exploitation indicators are observed or threat intelligence changes.