CVE-2026-42977

What it actually does

CVE-2026-42977 is a local elevation-of-privilege vulnerability caused by a race condition in Windows Push Notifications. An authenticated local attacker with low privileges can attempt to win a timing window around a shared resource that is not properly synchronized, causing the Windows Push Notifications component to perform an operation in a more privileged security context than intended. Successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability, with a scope change indicating that the gained privileges may cross a security boundary within the local system. Exploitation requires local access, valid low-privileged credentials, and high attack complexity because the attacker must reliably trigger the race condition.

Why it matters to the business

If exploited, this vulnerability can allow an attacker who already has a foothold on a Windows workstation or server to gain elevated privileges, potentially turning a limited compromise into full system control. That can enable credential theft, endpoint security tampering, lateral movement, persistence, and access to sensitive data. The issue affects supported Windows client and server platforms, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, so exposure may be broad in organizations with mixed Windows fleets. Current public risk signals are lower than many actively exploited flaws: EPSS is low at 0.00185, the 30-day EPSS trend is flat, no known exploitation was provided, and it is not listed in CISA KEV; however, privilege-escalation bugs are commonly chained with phishing, malware, remote code execution, or stolen credentials, so timely patching remains important.

How an attack unfolds

An attacker first obtains local access to a vulnerable Windows system, typically through stolen credentials, malware execution, exploitation of a separate initial-access vulnerability, or interactive access as a low-privileged user. The attacker then runs code that interacts with the Windows Push Notifications functionality and repeatedly triggers operations that access a shared resource. By carefully timing concurrent execution, the attacker attempts to win the race condition and cause the component to handle the shared resource in an unintended state. If successful, the attacker gains elevated local privileges and can then perform privileged actions such as dumping credentials, disabling protections, installing persistence, modifying system settings, or moving laterally. Because exploitation has high complexity, reliable weaponization may require repeated attempts, precise timing, and version-specific behavior, but the impact of success is severe.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42977 for all affected Windows versions: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no specific fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Intune, MECM/SCCM, or the Microsoft Update Catalog to deploy the relevant cumulative update released on or after the advisory publication date, then verify that each device reports the expected patched OS build. If immediate patching is not possible, reduce risk by limiting local interactive access, removing unnecessary local administrator rights, enforcing least privilege, blocking untrusted executable content, using application control, monitoring privilege-escalation behavior, and ensuring endpoint protection tamper controls are enabled. Disabling Windows Push Notifications should only be considered as a temporary, carefully tested mitigation where business functionality permits, because it may affect notification-dependent applications and user experience.

How to confirm the fix worked

Confirm remediation by checking that affected Windows endpoints and servers have installed the applicable Microsoft cumulative security update released on or after 2026-06-09 and are reporting patched OS builds through centralized patch management. Validate coverage across all affected product families, including Windows 10, Windows 11, and Windows Server systems. On individual systems, review Windows Update history, installed hotfixes, or OS build information using standard administrative tooling such as Settings, Windows Update, PowerShell Get-HotFix where applicable, systeminfo, winver, or enterprise endpoint management inventory. Confirm that update compliance data is current, that systems have rebooted where required, and that no rollback, failed installation, or update deferral policies are leaving assets exposed. For exposure validation, inventory machines running the listed Windows versions and compare their patch state against Microsoft’s release guidance for this vulnerability.

Typical attack path

1. Gain local code execution or an authenticated low-privileged session on a vulnerable Windows host.
2. Confirm the host is running an affected Windows client or server version and that the relevant Windows Push Notifications components are present.
3. Execute a local exploit that repeatedly triggers concurrent Windows Push Notifications operations against the improperly synchronized shared resource.
4. Win the race condition and cause privileged execution or privileged access to occur outside the intended authorization boundary.
5. Use the elevated privileges to execute administrative commands, access sensitive files, dump credentials, disable defenses, install persistence, or pivot to additional systems.

How to detect it

There are no unique public indicators of compromise or known exploit artifacts provided for this vulnerability, and race-condition privilege-escalation activity often leaves limited vulnerability-specific evidence. To assess whether exploitation may have occurred, hunt for post-exploitation behavior on affected Windows hosts, especially before patch installation. Review Windows Security logs for unusual privilege changes, new local administrators, suspicious service creation, scheduled task creation, log clearing, and abnormal process execution by low-privileged users. Useful event sources include Windows Security logs, System logs, PowerShell logs, Sysmon or EDR telemetry, service control manager events, Windows Defender/endpoint protection alerts, and authentication logs. Look for standard-user accounts spawning administrative tools, command shells, PowerShell, credential access tools, or security-control tampering shortly after interacting with notification-related components or service-host processes. Investigate suspicious parent-child process chains involving svchost.exe service groups, unexpected writes to privileged locations, newly created services, scheduled tasks, or binaries launched from user-writable directories such as Downloads, Temp, AppData, or ProgramData. Correlate findings with patch state: unpatched affected hosts showing local privilege changes or defense evasion activity should be treated as higher priority for forensic review. Because no named threat actors, ransomware use, or active exploitation were provided, detection should focus on generic Windows local privilege-escalation and post-exploitation patterns rather than CVE-specific signatures.

What your security team should do

• Prioritize patch deployment to Windows servers, privileged-access workstations, administrator jump hosts, shared workstations, developer workstations, and endpoints used by high-risk users.
• Deploy the applicable Microsoft cumulative security updates across all affected Windows 10, Windows 11, and Windows Server versions, and track reboot completion.
• Use centralized asset and patch management to identify unsupported, offline, update-deferred, or noncompliant Windows systems that remain exposed.
• Treat this primarily as a post-compromise privilege-escalation risk: pair patching with controls that reduce initial access, including phishing resistance, endpoint protection, application control, and least privilege.
• Review local administrator group membership, privileged account use, and endpoint hardening baselines to reduce the value of successful exploitation.
• Monitor for suspicious local privilege-escalation behavior, including unusual child processes from Windows service host processes, unexpected administrative tool execution by standard users, credential dumping attempts, and security tooling tampering.
• Because EPSS is low, flat, and no known exploitation or KEV listing was provided, schedule remediation according to normal high-severity OS patch SLAs unless threat intelligence, exploit release, or local risk factors justify emergency patching.
• Create a detection content review for Windows Push Notifications service activity and local privilege-escalation telemetry, recognizing that no unique public exploit indicators are currently available.