CVE-2026-45635: Windows UPnP Remote Code Execution Vulnerability (CVSS 8.1)

Technical summary

CVE-2026-45635 is a type confusion vulnerability (CWE-843) combined with use-after-free characteristics (CWE-416) in the UPnP implementation within upnp.dll. The vulnerability allows an unauthenticated network-based attacker to trigger a type mismatch condition that leads to arbitrary code execution with system-level privileges. The attack vector requires network access but does not require user interaction or elevated privileges to initiate. The CVSS 3.1 score of 8.1 (HIGH severity) reflects the network-adjacent attack surface, high complexity barrier, but complete impact across confidentiality, integrity, and availability.

Business impact

Organizations running affected Windows versions face risk of remote code execution attacks that could lead to data exfiltration, ransomware deployment, lateral movement, or persistent compromise. UPnP is commonly enabled on networked systems, including enterprise infrastructure, increasing the potential attack surface. Successful exploitation could result in regulatory violations (HIPAA, PCI-DSS, SOC 2), operational disruption, and breach notification obligations. The vulnerability is particularly concerning for organizations with internet-facing systems or those in shared network environments where UPnP traffic may be reachable from untrusted sources.

Affected systems

The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, and 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, and 26H1), as well as Windows Server 2012, 2016, 2019, 2022, and 2025. Essentially, all currently supported and extended-support Windows versions carry this risk. The broad scope of affected versions reflects the fundamental nature of the flaw in the core UPnP subsystem, which has remained largely unchanged across these releases.

Exploitability

Exploitation requires network access and intermediate technical complexity, but no user interaction or authentication. The attack can be delivered remotely, making it suitable for mass scanning and targeting. While the CVSS vector indicates high complexity (AC:H), this typically reflects mitigation factors such as environment-specific conditions or exploitation constraints rather than ease of weaponization. The absence of a public exploit at the time of publication does not reduce the practical risk, particularly given the high-value target (system code execution) and broad affected install base.

Remediation

Apply security updates from Microsoft that address the type confusion and use-after-free conditions in upnp.dll. Verify against the vendor advisory for specific patch versions applicable to your Windows version. Organizations unable to patch immediately should consider disabling or restricting UPnP traffic at the network perimeter, particularly for systems not requiring UPnP functionality. This can be accomplished through firewall rules blocking UDP port 1900 and TCP ports 49152–65535 (UPnP range) from untrusted networks.

Patch guidance

Consult the Microsoft Security Update Guide for the specific KB articles and patch versions corresponding to your affected Windows version. Given the publication date of June 9, 2026, and modification date of July 9, 2026, priority should be given to deploying patches in the subsequent Microsoft monthly update cycle. Plan patching in phases: critical internet-facing systems and servers first, then client systems, then legacy extended-support systems. Validate patch deployment through endpoint management tools and WSUS if applicable. Test patches in a controlled environment before production rollout to mitigate compatibility risks.

Detection guidance

Monitor network traffic for UPnP requests (UDP port 1900) from unexpected or untrusted sources. Implement intrusion detection signatures targeting malformed UPnP packets or type-confusion payloads in the M-SEARCH discovery protocol. Enable process monitoring and code execution alerts on systems running upnp.dll (typically svchost.exe -k LocalService). Log Windows Defender/WDEG detections and system call anomalies indicative of memory corruption exploitation. Correlate UPnP service crashes or restarts with suspicious network activity to identify exploitation attempts. Organizations with advanced endpoint detection and response (EDR) solutions should review behavioral heuristics for heap corruption and privilege escalation patterns.

Why prioritize this

This vulnerability merits immediate prioritization due to its HIGH CVSS severity score, network-exploitable attack vector, lack of authentication requirement, and impact on a core operating system component present across the entire Windows ecosystem. The type confusion and use-after-free combination suggests reliable exploitation potential despite the noted complexity factors. Organizations with broad Windows deployments, especially those with internet-facing assets or systems in DMZs, should treat this as a P1 remediation candidate. The long support tail of affected versions (including Windows Server 2012) compounds the urgency for legacy environment owners.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: network-based attack vector (AV:N) with no requirement for authentication (PR:N) or user interaction (UI:N), yielding broad attack surface; high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) due to arbitrary code execution as a system service; unchanged scope (S:U) indicating impact confined to the vulnerable component; and medium attack complexity (AC:H), which mitigates an otherwise critical score. The score appropriately emphasizes the practical risk while acknowledging exploitation barriers. This is a workable but serious vulnerability that justifies rapid patch deployment and compensating controls.

Frequently asked questions