CVE-2026-42978

What it actually does

CVE-2026-42978 is a local elevation-of-privilege vulnerability caused by improper synchronization of shared resources in the Windows Push Notifications component. A low-privileged, authenticated attacker who can run code on an affected Windows endpoint or server may be able to win a race condition and cause privileged operations to occur in an unintended order or context. Successful exploitation can result in privilege escalation with high impact to confidentiality, integrity, and availability. The attack complexity is high because exploitation depends on timing and local system behavior, but no user interaction is required once the attacker has local code execution.

Why it matters to the business

If exploited, this flaw can allow an attacker who already has limited access to a Windows system to gain much broader control, potentially leading to credential theft, security tool tampering, lateral movement, data access, and persistence. The issue affects many supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, so exposure may be broad in enterprise fleets. It is not currently listed in CISA KEV, has no known ransomware association, and has low EPSS with a flat 30-day trend, which suggests no strong public signal of widespread exploitation at this time; however, local privilege escalation bugs are commonly chained with phishing, malware execution, stolen credentials, or remote code execution to complete an intrusion.

How an attack unfolds

An attacker first obtains low-privileged local code execution on an affected Windows system, such as through malware, a compromised user account, or another vulnerability. The attacker then interacts with Windows Push Notifications-related services or APIs in a way that repeatedly triggers concurrent operations involving shared state. By carefully controlling timing, process creation, thread scheduling, or request sequencing, the attacker attempts to win the race condition and force the service into an inconsistent security state. If successful, the attacker causes a privileged action to be performed under a higher-privileged context than intended, resulting in local privilege escalation. After privilege escalation, the attacker may dump credentials, disable defenses, install persistence, access sensitive files, or move laterally. There are no named threat actors or public exploit maturity indicators in the provided intelligence, and exploitation is expected to require local access and reliable timing rather than simple remote triggering.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-42978 for the affected Windows version as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or other patch-management tooling. Because no exact fixed build or KB numbers were provided, validate remediation against Microsoft’s official advisory and the installed OS build number for each affected platform. Prioritize internet-adjacent administrative workstations, shared servers, jump hosts, VDI images, developer workstations, and systems where low-privileged users can execute code. If immediate patching is not possible, reduce exploitability by limiting local logon rights, removing unnecessary local administrator pathways, enforcing application control, restricting script execution, monitoring for suspicious local privilege escalation behavior, and ensuring EDR tamper protection is enabled. Avoid disabling Windows Push Notifications services broadly unless Microsoft or internal compatibility testing confirms it is safe, as doing so may disrupt user and application notification functionality.

How to confirm the fix worked

Confirm that each affected system has installed the Microsoft security update or cumulative update containing the fix for its specific Windows release. Validate OS build numbers using inventory tools, PowerShell, endpoint management platforms, or vulnerability scanners, and compare them with Microsoft’s official fixed build guidance. Run authenticated vulnerability scans against representative Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets. Confirm that golden images, offline images, VDI templates, and server templates are updated, not just running endpoints. Where patch validation is not available by CVE mapping, verify that the system is on a cumulative update released after the vendor fix date and that vulnerability scanner plugins no longer report the issue. For mitigations, validate that low-privileged users cannot install or run unapproved binaries and that security telemetry captures process creation, privilege changes, service changes, and PowerShell/script execution.

Typical attack path

1. Gain authenticated, low-privileged access to an affected Windows workstation or server.
2. Execute attacker-controlled code locally through malware, scripting, an interactive session, or a chained vulnerability.
3. Identify that the host is running an affected Windows version and that Windows Push Notifications-related services/components are present.
4. Repeatedly trigger the vulnerable notification component while manipulating timing or concurrency to exploit the race condition.
5. Achieve execution or privileged action in an elevated security context.
6. Use elevated privileges to access credentials, modify system settings, disable security controls, establish persistence, or expand access to other systems.

How to detect it

There are no public exploit indicators, named threat actors, or known ransomware usage in the provided intelligence, so detection should focus on behavioral evidence of local privilege escalation involving Windows services and abnormal activity around Windows Push Notifications components. Review endpoint detection telemetry, Windows Security logs, Sysmon, PowerShell logs, service-control activity, and process creation logs for low-privileged users spawning repeated or unusual interactions with notification-related services followed by elevated processes, account changes, credential access, or defense evasion. Useful Windows log sources include Security events for logon and privilege use, process creation if enabled, service installation or configuration changes, Sysmon process/service events, PowerShell Operational logs, and Push Notifications operational logs where present. Look for sequences where a non-admin user runs unfamiliar binaries or scripts, repeatedly triggers notification-related components, and shortly afterward obtains administrative privileges, modifies local group membership, dumps credentials, disables security tools, or creates persistence. Because exploitation is local and race-condition based, indicators may be noisy and host-specific; prioritize correlated timelines over single artifacts.

• WpnService
• WpnUserService
• WpnUserService_
• Microsoft-Windows-PushNotifications-Platform/Operational
• Microsoft-Windows-PushNotifications-Developer/Operational
• svchost.exe -k UnistackSvcGroup
• sc.exe query WpnService
• sc.exe query WpnUserService
• net localgroup administrators /add
• Add-LocalGroupMember -Group Administrators
• whoami /priv
• wevtutil cl Security
• powershell.exe -ExecutionPolicy Bypass
• cmd.exe /c sc config
• reg add HKLM\SYSTEM\CurrentControlSet\Services\WpnService

What your security team should do

• Prioritize patch deployment to affected Windows endpoints and servers, especially systems used for administration, shared access, or high-value workloads.
• Use authenticated asset inventory to identify all Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 systems and map them to the appropriate Microsoft fixed update once published in official guidance.
• Treat this primarily as a post-compromise privilege-escalation risk: focus on reducing local code execution opportunities through application control, least privilege, and script restrictions.
• Hunt for suspicious privilege escalation activity on Windows systems, including unexpected child processes from service-hosted components, new local administrators, security tool tampering, and abnormal token/privilege use.
• Ensure EDR, Windows event logging, PowerShell logging, and process command-line auditing are enabled before and after remediation to support exploitation review.
• Review local admin membership, service account privileges, and interactive logon rights on affected systems to reduce blast radius if exploitation occurs.
• Monitor Microsoft advisories, exploit databases, and threat intelligence feeds for changes in exploit maturity, KEV status, or ransomware usage, and raise priority if public exploitation emerges.