Cyber Posture

CVE-2026-27920

High

Published: 14 April 2026

Published
14 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0005 15.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27920 is a high-severity Untrusted Pointer Dereference (CWE-822) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely flaw remediation through vendor patches directly eliminates the untrusted pointer dereference vulnerability in Windows UPnP Device Host.

prevent

Memory protection mechanisms such as non-executable memory and address space randomization directly mitigate exploitation of untrusted pointer dereference leading to privilege escalation.

prevent

Configuring systems to least functionality by disabling unnecessary UPnP Device Host removes the attack surface for local privilege escalation.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Local untrusted pointer dereference in Windows UPnP Device Host directly enables local privilege escalation to higher privileges (e.g., SYSTEM).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

Deeper analysisAI

CVE-2026-27920 is an untrusted pointer dereference vulnerability (CWE-822) in the Windows Universal Plug and Play (UPnP) Device Host. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its potential for significant impact on confidentiality, integrity, and availability.

The vulnerability can be exploited by an authorized local attacker with low privileges. Successful exploitation enables local privilege escalation, allowing the attacker to gain higher-level access on the affected Windows system.

Microsoft has published an update guide addressing this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27920.

Details

CWE(s)

Affected Products

microsoft
windows 10 1607
≤ 10.0.14393.9060 · ≤ 10.0.14393.9060
microsoft
windows 10 1809
≤ 10.0.17763.8644 · ≤ 10.0.17763.8644
microsoft
windows 10 21h2
≤ 10.0.19044.7184 · ≤ 10.0.19044.7184 · ≤ 10.0.19044.7184
microsoft
windows 10 22h2
≤ 10.0.19045.7184 · ≤ 10.0.19045.7184 · ≤ 10.0.19045.7184
microsoft
windows 11 23h2
≤ 10.0.22631.6936 · ≤ 10.0.22631.6936
microsoft
windows 11 24h2
≤ 10.0.26100.8246 · ≤ 10.0.26100.8246
microsoft
windows 11 25h2
≤ 10.0.26200.8246 · ≤ 10.0.26200.8246
microsoft
windows 11 26h1
≤ 10.0.28000.1836 · ≤ 10.0.28000.1836
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
≤ 10.0.14393.9060
+4 more product configuration(s) — see NVD for full list

CVEs Like This One

CVE-2026-32077Same product: Microsoft Windows 10 1607
CVE-2026-27919Same product: Microsoft Windows 10 1607
CVE-2025-24990Same product: Microsoft Windows 10 1607
CVE-2026-20857Same product: Microsoft Windows 10 1809
CVE-2025-21358Same product: Microsoft Windows 10 1607
CVE-2026-20940Same product: Microsoft Windows 10 1607
CVE-2026-26161Same product: Microsoft Windows 10 1809
CVE-2026-27916Same product: Microsoft Windows 10 1607
CVE-2026-26168Same product: Microsoft Windows 10 1607
CVE-2026-24294Same product: Microsoft Windows 10 1607

References