CVE-2026-42973

What it actually does

CVE-2026-42973 is a local information disclosure vulnerability in Windows Push Notifications caused by use of an uninitialized resource. A low-privileged, authorized local attacker can trigger the vulnerable Windows Push Notifications code path and potentially cause sensitive data to be returned or exposed from a resource that was not properly initialized before use. The vulnerability does not provide remote code execution, privilege escalation, integrity modification, or denial of service by itself, but it has high confidentiality impact when exploitable data is sensitive.

Why it matters to the business

The main risk is unauthorized exposure of sensitive local information from affected Windows endpoints or servers. Because exploitation requires local authenticated access, the issue is most relevant on shared workstations, virtual desktop infrastructure, jump hosts, terminal servers, developer systems, and compromised endpoints where an attacker already has a foothold. Current public risk signals are lower: it is not listed in CISA KEV, is not known to be used in ransomware campaigns, has no reported exploit maturity, and has a low, stable EPSS score of 0.00404 over 30 days. However, the affected product set is broad across Windows 10, Windows 11, and multiple Windows Server releases, so organizations should include it in normal Windows patch cycles and prioritize higher-risk multi-user systems.

How an attack unfolds

An attacker first obtains valid local access to an affected Windows system, such as through stolen credentials, malware running as a standard user, or access to a shared host. The attacker then runs a local program or script that interacts with the Windows Push Notifications functionality in a way that reaches the vulnerable code path. Because the affected component may use a resource before it is initialized, data not intended for the attacker can be disclosed to the attacking process or user context. The attacker can then inspect the returned data for useful information, such as local application data, notification-related content, tokens, metadata, or other sensitive fragments, and use any recovered information to support follow-on activity. This vulnerability is best understood as a post-access information leak that can improve an attacker’s situational awareness rather than as an initial compromise vector.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42973 for all affected supported Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2016, 2019, 2022, and 2025. No exact fixed build or package versions were provided in the input, so administrators should use the Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, or their endpoint management platform to identify the applicable cumulative update for the affected OS release. Prioritize shared, multi-user, internet-administered, and high-value systems. Where immediate patching is not possible, reduce exposure by limiting interactive logon rights, removing unnecessary local users, enforcing least privilege, using application control to block untrusted local executables, and closely monitoring suspicious local process execution. Disabling Windows Push Notifications may reduce exposure in some environments but can affect user and application functionality and should be tested before deployment.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft cumulative update or security update that supersedes the June 2026 advisory for this vulnerability. Use enterprise vulnerability scanners authenticated to the host, Windows Update compliance reporting, WSUS or Microsoft Configuration Manager deployment status, and OS build/KB inventory to confirm coverage. Validate that unsupported or out-of-servicing Windows releases are upgraded or isolated. For high-risk systems, confirm that standard users cannot run unauthorized local tools, that local logon rights are restricted to approved users, and that endpoint telemetry is collecting process creation, PowerShell/script execution, and Windows service activity involving Windows Push Notifications components.

Typical attack path

1. Gain authenticated local access to an affected Windows workstation or server.
2. Run a local process under a low-privileged user context.
3. Trigger Windows Push Notifications functionality that reaches the vulnerable uninitialized-resource code path.
4. Capture or inspect data exposed by the vulnerable component.
5. Search the disclosed information for sensitive local data, credentials, tokens, application metadata, or environment details.
6. Use any recovered information to assist lateral movement, account targeting, or further exploitation.

How to detect it

There are no public, specific exploitation indicators available from the provided information, and successful exploitation may leave minimal or no dedicated Windows event artifacts because it is a local information disclosure flaw. Detection should focus on signs of post-compromise local activity around the affected component. Review EDR, Sysmon, Windows Security logs, PowerShell logs, and application-control logs for unusual non-administrative processes interacting with Windows Push Notifications services or related service-host processes. Useful telemetry includes process creation events, parent-child process relationships, unsigned or newly dropped executables, command lines invoking local probing tools, PowerShell or script execution by standard users, abnormal access to user profile data after notification-service interaction, and suspicious activity on shared or multi-user systems. Correlate these events with successful logons, especially interactive logons, remote interactive logons, or signs of credential theft. Because there are no known KEV, ransomware, or named threat actor associations in the input, detections should be behavior-based rather than IOC-only.

What your security team should do

• Include this vulnerability in the next scheduled Windows patch cycle, with accelerated patching for shared workstations, VDI, terminal servers, jump hosts, and privileged administration systems.
• Use authenticated vulnerability scanning or endpoint management inventory to identify affected Windows 10, Windows 11, and Windows Server systems missing the relevant Microsoft update.
• Prioritize remediation on systems where multiple users can log on interactively or where compromise of local information could expose privileged workflows or sensitive applications.
• Review local user and remote interactive logon permissions and remove unnecessary access to reduce the population of users able to exploit local-only vulnerabilities.
• Ensure endpoint detection and response tooling captures process creation, command-line arguments, script execution, and suspicious interaction with Windows notification services.
• Monitor for unusual local processes, unsigned binaries, or scripts executed by non-administrative users shortly before suspicious access to sensitive local data.
• Do not treat this as an internet-facing remote exploitation issue unless paired with another vulnerability or an existing foothold; focus on patching and post-compromise detection.