CVE-2026-42979

What it actually does

This is a local privilege-escalation flaw caused by improper synchronization of a shared resource in the Windows Push Notifications component. A low-privileged, authenticated attacker with local code execution can attempt to trigger a race condition so the component operates on inconsistent state or an object whose security context has changed unexpectedly. Successful exploitation can cross a privilege boundary and grant the attacker elevated rights, potentially allowing full confidentiality, integrity, and availability impact on the affected Windows host. The attack complexity is high because exploitation depends on precise timing and local execution conditions, but no user interaction is required once the attacker has code running as a low-privileged user.

Why it matters to the business

If exploited, an attacker who already has a foothold on a workstation or server could turn limited access into administrative control of the system. This can enable credential theft, disabling security tools, persistence installation, lateral movement, ransomware staging, and tampering with business-critical services. The issue affects supported Windows client and server releases including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025, so exposure may be broad in mixed enterprise fleets. Current public exploitation signals are low: EPSS is approximately 0.00185, the 30-day trend is flat, it is not listed in CISA KEV, and no exploit maturity is reported; however, local privilege-escalation bugs are commonly chained with phishing, malware, stolen credentials, or remote code execution to complete an intrusion.

How an attack unfolds

An attacker first obtains local, low-privileged execution on an affected Windows system through another vector such as malware delivery, an exposed application, malicious document execution, stolen user credentials, or post-compromise tooling. The attacker then runs code that repeatedly interacts with Windows Push Notifications-related functionality while attempting to create a timing window around a shared resource that is not synchronized correctly. If the race is won, the component may perform an operation using stale, confused, or attacker-influenced state, allowing the attacker to escape the original low-privileged security context. With elevated privileges, the attacker can create or modify privileged accounts, dump credentials, disable endpoint defenses, install persistence, access sensitive local data, or move laterally. Because the flaw requires local access and reliable timing, exploitation is more likely as part of a chained attack than as a standalone initial-access technique.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for each affected Windows version. Prioritize endpoints and servers where users can log on interactively, systems exposed to untrusted users, virtual desktop infrastructure, jump hosts, developer workstations, and servers where compromise would enable broad lateral movement. Because no fixed version list was provided, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the applicable cumulative update for Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Where immediate patching is not possible, reduce risk by limiting interactive logon rights, removing local administrator rights from standard users, enforcing application control, ensuring endpoint detection and response is active, blocking untrusted script execution, and monitoring for privilege-escalation behavior. Disabling Windows Push Notifications broadly may disrupt legitimate user and application notification workflows and should only be considered as a temporary, tested mitigation if supported by business requirements.

How to confirm the fix worked

Confirm that the applicable Microsoft cumulative security update is installed on every affected system. Validate through centralized patch reporting, Windows Update compliance, endpoint management inventory, or local commands such as checking installed hotfixes and OS build numbers against Microsoft’s advisory for the issue. For representative systems, verify that Windows client and server builds are at or above the patched build level published by Microsoft. Run authenticated vulnerability scans after patch deployment to confirm the finding is no longer reported. Also confirm that compensating controls are in place for systems that cannot be patched immediately, including restricted local logon, application control, EDR coverage, and alerting on suspicious privilege escalation. Because this is a local privilege-escalation issue, external network scans alone are not sufficient to validate remediation.

Typical attack path

1. Gain local code execution as a standard or otherwise low-privileged Windows user.
2. Verify the host is an affected Windows client or server build and that Windows Push Notifications-related services/components are present.
3. Run a local exploit that stresses or races Windows Push Notifications shared-resource handling.
4. Win the race condition so the vulnerable component performs a privileged action using inconsistent or attacker-controlled state.
5. Obtain elevated privileges on the local system.
6. Use elevated access to dump credentials, disable defenses, install persistence, modify system configuration, or pivot to other systems.

How to detect it

There are no public, vulnerability-specific indicators or known exploit artifacts reported for this issue, so detection should focus on behavioral evidence of local privilege escalation and post-exploitation on affected, unpatched Windows systems. Review Windows Security logs for unusual sequences where a standard user account is followed by privileged logons, special privilege assignment, local group membership changes, service creation, scheduled task creation, or security policy changes. Relevant Windows events include 4624, 4672, 4688, 4697, 4698, 4702, 4720, 4728, 4732, 4738, 7045 from the System log, and PowerShell operational logging where enabled. Review Sysmon or EDR telemetry for suspicious process creation, token manipulation, process injection, credential access, or unexpected child processes from service-hosted Windows components. Pay particular attention to activity around Windows Push Notifications services and service-hosted processes when correlated with a low-privileged user session and a sudden elevation to SYSTEM or administrator-level activity. Investigate any endpoint where EDR shows exploit-like behavior such as repeated rapid calls to a Windows service, abnormal handle manipulation, privilege escalation detections, LSASS access following a low-privileged process, or immediate defense tampering. Since exploitation is local and timing-based, absence of a network indicator does not prove absence of compromise; correlate patch state, user execution history, EDR alerts, and privilege-change events.

What your security team should do

• Patch affected Windows clients and servers through the normal emergency or high-priority OS update process, prioritizing systems used for administration, remote access, development, and high-value workloads.
• Inventory affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025 assets and track patch compliance until all supported systems are remediated.
• Treat the vulnerability as a likely post-compromise privilege-escalation enabler rather than an initial-access vector; review recent alerts where malware or suspicious user execution occurred on unpatched systems.
• Harden endpoints by enforcing least privilege, removing unnecessary local administrator rights, enabling credential protection, and applying application control or attack surface reduction rules where feasible.
• Monitor for suspicious privilege transitions, new local administrators, unusual service creation, credential dumping activity, security tool tampering, and unexpected child processes spawned from Windows service host processes.
• For systems that cannot be patched quickly, restrict interactive access to trusted administrators and increase logging/EDR sensitivity until remediation is complete.
• Because EPSS is currently low, flat, and there is no KEV listing, prioritize based on asset criticality and exposure, but do not defer indefinitely because local privilege-escalation flaws are frequently used in chained intrusions.