CVE-2026-69351: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-69351 and classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor), affects multiple versions of Microsoft Windows 10 including Version 1607 and later builds up to certain patched versions. It specifically impacts the Windows Universal Plug and Play (UPnP) Device Host, enabling an attacker with local authorized access to disclose private personal information. The CVSS 3.1 base score is 5.5, indicating medium severity, with attack vector local, low attack complexity, and low privileges required. The vulnerability does not affect system integrity or availability but compromises confidentiality. Microsoft has issued an official fix to address this issue.

An attacker with local authorized access can exploit this vulnerability to disclose private personal information from the affected Windows systems. There is no impact on system integrity or availability. The confidentiality breach could lead to unauthorized access to sensitive data.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69351. No additional mitigation steps are required beyond applying the official patch.