CVE-2026-32159

What it actually does

CVE-2026-32159 is a local elevation-of-privilege vulnerability caused by improper synchronization of a shared resource in the Windows Push Notifications component. A low-privileged, authenticated local attacker who can win the race condition may cause privileged notification-service logic to operate on attacker-influenced state, potentially allowing execution or actions with elevated privileges. Successful exploitation can compromise confidentiality, integrity, and availability on the local system, but it requires local access and has high attack complexity.

Why it matters to the business

If exploited, this vulnerability can allow an attacker who already has a foothold on a Windows workstation or server to gain higher privileges, making it easier to disable security tools, access sensitive data, install persistence, move laterally, or deploy additional malware. It affects widely deployed Windows 10, Windows 11, and Windows Server versions, so exposure may be broad across enterprise fleets. Current public risk signals are lower than many internet-facing vulnerabilities: EPSS is low and flat at 0.00201, it is not listed in CISA KEV, no ransomware use is reported, and no public exploit maturity is indicated; however, local privilege escalation flaws are commonly chained with phishing, malware, remote code execution, or stolen-credential activity.

How an attack unfolds

An attacker first obtains local code execution as a standard user, typically through phishing, malicious documents, a compromised account, or another vulnerability. The attacker then runs code that interacts with Windows Push Notifications and repeatedly triggers the vulnerable race window involving shared state handled without proper synchronization. If the timing condition is won, the notification component may perform privileged operations using attacker-controlled or stale state. The attacker can then use the elevated context to execute follow-on actions such as creating privileged processes, modifying protected system settings, tampering with endpoint defenses, dumping credentials, or establishing persistence. Because the vulnerability has high attack complexity, reliable exploitation likely requires precise timing, repeated attempts, and environment-specific tuning.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32159 for all affected Windows versions, including Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. If exact fixed build numbers are not available in asset tooling, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to install the cumulative update released for this vulnerability or any later cumulative update for the relevant OS branch. Prioritize systems where untrusted users can log on interactively, shared workstations, VDI, jump hosts, developer workstations, and servers that permit non-administrative local access. As interim risk reduction, limit local logon rights, remove unnecessary standard-user access from servers, enforce application control, restrict script execution, enable endpoint protection tamper protection, and monitor for suspicious privilege escalation behavior. Disabling Windows Push Notifications may affect user and application functionality and should be considered only as a temporary, tested mitigation where operationally acceptable.

How to confirm the fix worked

Confirm that each affected asset is running a Windows build that includes the Microsoft cumulative update addressing this vulnerability or a later cumulative update. Validate through centralized patch compliance tooling, Windows Update history, installed hotfix inventory, and OS build reporting. On individual hosts, review Settings > Windows Update > Update history, query installed updates with PowerShell or enterprise management tooling, and compare the OS build against Microsoft’s release notes for the applicable Windows branch. Confirm that unsupported or out-of-servicing Windows releases are upgraded to supported branches that receive security fixes. For exposure validation, inventory Windows 10, Windows 11, and Windows Server systems and identify those without the relevant post-April 2026 security update baseline. For mitigation validation, confirm local logon restrictions, application control policy enforcement, endpoint protection health, and alerting for suspicious local privilege escalation activity.

Typical attack path

1. Gain local access to an affected Windows system as a low-privileged authenticated user.
2. Stage or execute a local exploit that targets the Windows Push Notifications component.
3. Trigger notification-related activity repeatedly to create contention on the shared resource affected by the race condition.
4. Win the race condition so privileged service logic acts on attacker-influenced state.
5. Obtain elevated privileges or perform privileged local actions.
6. Use the elevated access to disable controls, collect credentials or sensitive data, establish persistence, or move laterally.

How to detect it

Because this is a local race-condition privilege escalation and no public exploit indicators are provided, detection should focus on behavioral evidence of post-exploitation rather than a single reliable signature. Collect and review Windows Security logs, Sysmon or EDR telemetry, Microsoft Defender for Endpoint alerts, service-control events, process creation events, PowerShell logs, WMI activity, scheduled task creation, local account/group changes, and endpoint protection tamper events. Look for low-privileged user sessions followed by unexpected elevated process creation, SYSTEM-context command shells, new or modified services, suspicious scheduled tasks, credential-dumping activity, LSASS access, security tool disablement, or abrupt privilege changes without legitimate administrative workflow. Review activity involving Windows Push Notifications services such as WpnService and per-user WpnUserService instances when correlated with unusual process trees, repeated crashes, service restarts, or privilege escalation events. Useful Windows event sources include Security event IDs 4688, 4672, 4624, 4720, 4728, 4732, 7045 from System/Service Control Manager, PowerShell operational logs, Sysmon event IDs 1, 7, 10, 11, 12, 13, 22, and EDR process lineage. Since EPSS is low, no KEV listing exists, and exploit maturity is reported as none, prioritize investigation when these behaviors appear alongside other intrusion indicators such as phishing execution, malware staging, suspicious downloads, or lateral movement.

What your security team should do

• Patch affected Windows endpoints and servers through the standard cumulative update channel, prioritizing systems with interactive users, shared access, or elevated business criticality.
• Use asset inventory to identify all affected Windows 10, Windows 11, and Windows Server versions and track remediation to completion.
• Treat this primarily as a post-compromise privilege-escalation risk and ensure it is included in endpoint hardening and attack-chain reduction priorities.
• Review where non-administrative users can log on to servers and reduce unnecessary local access.
• Harden endpoints with application control, script restrictions, least privilege, endpoint detection and response, and tamper protection.
• Monitor for suspicious privilege escalation patterns, including standard-user processes spawning elevated shells, creating services, modifying privileged configuration, or disabling security tools.
• Investigate any endpoint compromise alerts around the same timeframe as local privilege changes, even though no public exploitation or KEV listing is currently reported.
• Maintain heightened awareness if exploit maturity changes, EPSS increases, Microsoft issues additional guidance, or threat intelligence reports active exploitation.