PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45599 Microsoft CVE debrief

CVE-2026-45599 is a HIGH severity vulnerability in Microsoft Windows. This use after free vulnerability in Universal Plug and Play (upnp.dll) allows an attacker to execute code over a network. The vulnerability was published on 2026-06-09 and modified on 2026-06-11.

Vendor
Microsoft
Product
Windows 10 Version 1607
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-09
Original CVE updated
2026-06-11
Advisory published
2026-06-09
Advisory updated
2026-06-11

Who should care

Administrators and users of Microsoft Windows systems, particularly those with Universal Plug and Play (UPnP) enabled, should be aware of this vulnerability.

Technical summary

The vulnerability is a use-after-free issue in the Universal Plug and Play (upnp.dll) component of Microsoft Windows. This type of vulnerability occurs when a program uses memory after it has been freed, allowing an attacker to potentially execute arbitrary code.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches from Microsoft as soon as available.
  • Disable UPnP if not required.
  • Use firewalls and network segmentation to limit exposure.
  • Monitor for suspicious network activity.

Evidence notes

The CVE-2026-45599 vulnerability has a CVSS score of 8.1 and is considered HIGH severity. The vulnerability affects multiple versions of Microsoft Windows, including Windows 10, Windows 11, and Windows Server.

Official resources

CVE-2026-45599 was published on 2026-06-09 and modified on 2026-06-11.