CVE-2026-42991

What it actually does

This is a local privilege-escalation race condition in the Windows Push Notifications component. An authenticated local attacker with low privileges can attempt to win a timing window involving improperly synchronized shared resources, causing the notification service or related Windows service-hosted component to perform an operation under a higher-privileged security context. Successful exploitation can allow elevation to a more privileged local context, potentially including SYSTEM-level privileges, with high confidentiality, integrity, and availability impact. Exploitation requires local access and precise timing, reflected by the high attack complexity, but it does not require user interaction.

Why it matters to the business

If exploited after an attacker has gained a basic foothold on a Windows workstation or server, this flaw can turn limited access into full control of the device. That can enable credential theft, disabling security tools, lateral movement, persistence, data access, and deployment of malware. The affected product set includes common Windows 10, Windows 11, and Windows Server versions, so exposure may be broad across enterprises. Current risk signals are lower than actively exploited vulnerabilities: EPSS is low and stable at approximately 0.0017 over 30 days, it is not listed in CISA KEV, no ransomware use is reported, and no public exploit maturity is indicated. However, because privilege-escalation flaws are commonly chained with phishing, browser, VPN, or remote-code-execution footholds, remediation should still be prioritized through normal Windows security patching cycles.

How an attack unfolds

An attacker first obtains authenticated local code execution on an affected Windows system, for example through stolen credentials, malware execution, abuse of a legitimate remote administration channel, or exploitation of another vulnerability. The attacker then runs a purpose-built local exploit that repeatedly interacts with Windows Push Notifications functionality and attempts to trigger concurrent operations against a shared resource. By carefully controlling timing, thread scheduling, and repeated attempts, the exploit tries to win the race window where authorization or object state is checked separately from how the resource is later used. If successful, the Windows component performs an operation using a higher-privileged context than the attacker should have. The attacker then uses the elevated context to spawn a privileged process, modify system configuration, dump credentials, disable defenses, install persistence, or move laterally. Because this is a local privilege-escalation issue, it is most useful as a second-stage exploit after initial access rather than as an internet-facing entry point.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; and Windows Server 2025. Because no exact fixed build numbers were provided in the input, use Microsoft Update, Windows Update for Business, WSUS, Configuration Manager, or the Microsoft Update Catalog to deploy the relevant cumulative security update for the affected release and confirm the system is on a build containing the June 2026 or later security fix for this CVE. Where immediate patching is not possible, reduce exposure by enforcing least privilege, limiting interactive logon rights on servers, restricting local administrator membership, blocking untrusted executable execution through application control, monitoring suspicious local privilege-escalation behavior, and ensuring endpoint detection controls cannot be disabled by standard users. Disabling Windows Push Notifications may reduce some attack surface in limited scenarios, but it should not be treated as a complete substitute for patching unless explicitly recommended by Microsoft for the affected configuration.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the applicable cumulative security update that includes the vendor fix for this vulnerability. Validate through centralized patch management reports, Windows Update history, installed hotfix inventory, or OS build-number compliance against Microsoft’s release notes for the affected Windows version. Security teams can also run authenticated vulnerability scans that check for the specific CVE or missing Microsoft security update. For exposure validation, inventory all Windows 10, Windows 11, and Windows Server versions listed as affected and identify systems that are unsupported, delayed from cumulative updates, excluded from patch groups, or not recently reporting patch status. Because exploitation requires local authenticated access, also validate that non-administrative users cannot write to privileged execution paths, cannot install arbitrary services, and cannot disable endpoint controls.

Typical attack path

1. Gain low-privileged authenticated access to an affected Windows workstation or server.
2. Transfer or stage a local privilege-escalation exploit on the host.
3. Execute the exploit repeatedly to trigger the Windows Push Notifications race condition.
4. Win the timing window and cause privileged operations to occur under an elevated context.
5. Spawn or inject into a higher-privileged process, potentially SYSTEM.
6. Use elevated access to dump credentials, change security settings, establish persistence, access sensitive data, or move laterally.

How to detect it

There are no known public exploit artifacts, KEV listing, ransomware associations, or named threat actors for this vulnerability based on the provided data, and race-condition privilege escalation often leaves few vulnerability-specific traces. Detection should therefore focus on post-exploitation behavior rather than a single signature. Review endpoint detection telemetry, Windows Security logs, Sysmon logs, PowerShell logs, service-control events, crash telemetry, and Windows Push Notifications-related operational logs for suspicious activity by low-privileged users followed by sudden high-integrity or SYSTEM execution. Key events to examine include new process creation from user-writable paths, unexpected SYSTEM shells or scripting engines, suspicious service creation, scheduled task creation, token impersonation indicators, credential dumping attempts, LSASS access, endpoint protection tampering, and unusual crashes or restarts of notification-related service-hosted processes. Correlate event timelines where a standard user process rapidly precedes privileged process creation, new administrative group membership, security tool disablement, or lateral movement. Useful Windows event sources include Security event IDs 4688 for process creation, 4672 for special privileges assigned, 4624 for logon activity, 7045 for service installation, 4698 for scheduled task creation, 4732 for local group membership changes, PowerShell 4103 and 4104 for script activity, and Sysmon events 1, 7, 10, 11, and 13 where available. Because normal Windows Push Notifications activity is common, detections should emphasize abnormal parent-child process relationships, execution from temporary or user profile directories, repeated crashes, and privilege transitions rather than the presence of notification services alone.

What your security team should do

• Inventory affected Windows 10, Windows 11, and Windows Server systems and prioritize patching of internet-adjacent workstations, jump hosts, privileged access workstations, domain administration workstations, and multi-user servers.
• Deploy the applicable Microsoft cumulative security update through the organization’s normal Windows patching process and verify successful installation with build-level or update-level evidence.
• Treat this primarily as a post-compromise privilege-escalation risk: pair patching with hunts for recent low-privilege-to-SYSTEM transitions, suspicious service creation, credential dumping, and endpoint-defense tampering.
• Enforce least privilege by reducing local administrator membership, restricting interactive logon to servers, and applying application control to prevent untrusted local exploit binaries from running.
• Increase monitoring on systems where patching is delayed, especially for suspicious child processes spawned from service-hosted Windows components, abnormal crashes, and rapid repeated interactions with notification-related services.
• Do not defer solely because EPSS is low or the issue is not in CISA KEV; privilege-escalation vulnerabilities are frequently valuable when chained with other initial-access techniques.