CVE-2026-50339

What it actually does

This is a local information-disclosure vulnerability in the Windows Push Notifications component. An attacker who already has a valid local user context can access sensitive notification-related information that should not be exposed to that user. The CVSS vector indicates low attack complexity, local access, low privileges, no user interaction, and high confidentiality impact, with no direct integrity or availability impact. The flaw does not by itself provide remote code execution or privilege escalation, but it may expose data useful for follow-on compromise.

Why it matters to the business

Successful exploitation could allow a malicious insider, compromised low-privileged account, or malware already running on a Windows system to read sensitive notification data or related secrets. This may lead to exposure of personal, operational, or application-related information and could support credential theft, social engineering, session abuse, or reconnaissance. The issue affects multiple supported Windows desktop and server releases, including Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, and Windows Server 2025. It is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score, so urgency is moderate unless systems are high-risk shared workstations, VDI, jump hosts, servers with interactive logons, or endpoints exposed to untrusted local users.

How an attack unfolds

An attacker first obtains a foothold on an affected Windows system as a standard authenticated user, such as through phishing, malware execution, stolen credentials, or legitimate local access. The attacker then interacts with local Windows Push Notifications functionality or associated local data exposed by the vulnerable component. Because the component improperly exposes sensitive information to an unauthorized local actor, the attacker can retrieve data that should be isolated from that account. The disclosed information may include notification content, metadata, identifiers, or other sensitive artifacts handled by the push notification subsystem. The attacker can then use that information for reconnaissance, lateral movement planning, user impersonation attempts, or further compromise, depending on what data is exposed in the affected environment.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions: Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. Because no fixed build numbers were provided in the input, use the applicable Microsoft cumulative update or servicing stack guidance for the relevant release channel. Prioritize systems where untrusted users can log on locally, shared workstations, VDI hosts, terminal servers, administrator workstations, jump hosts, and servers that permit interactive sign-in. As interim risk reduction, restrict local and remote interactive logon rights, remove unnecessary local accounts, enforce least privilege, monitor endpoint compromise indicators, and limit exposure of sensitive application notifications on shared systems.

How to confirm the fix worked

Confirm that the applicable Microsoft security update is installed on each affected Windows release using enterprise patch management, Windows Update history, Microsoft Defender Vulnerability Management, WSUS, Configuration Manager, Intune, or equivalent tooling. Validate that operating system builds match or exceed the patched cumulative update level published by Microsoft for this vulnerability. Run authenticated vulnerability scans after patch deployment to verify the CVE is no longer reported. On representative systems, confirm Windows Push Notifications services continue to operate normally and that standard users cannot access notification data outside their authorization boundary. For high-risk endpoints, review local group membership and interactive logon rights to ensure only approved users can sign in.

Typical attack path

1. Gain local authenticated access to an affected Windows 10, Windows 11, or Windows Server system.
2. Run code or commands under a low-privileged user context.
3. Interact with Windows Push Notifications functionality or local notification-related artifacts exposed by the vulnerable component.
4. Extract sensitive information that should not be accessible to that user.
5. Use the disclosed information to support follow-on activity such as credential targeting, user profiling, session abuse, or lateral movement.

How to detect it

There are no public, vulnerability-specific exploitation indicators provided for this issue, and local information-disclosure activity may not produce distinctive logs. Detection should focus on signs of suspicious local activity on affected Windows systems before patching. Relevant sources include Windows Security logs for interactive and remote logons, process creation telemetry from EDR or Sysmon, PowerShell logs, Windows Push Notifications operational logs if enabled, and file or registry access telemetry where available. Look for low-privileged users or unexpected processes accessing notification-related services, user profile notification caches, or Windows Push Notification components. Correlate such activity with suspicious parent processes, recently created local accounts, abnormal logon times, credential theft tooling, or malware alerts. Because exploitation requires local authenticated access, also review evidence of initial access, persistence, and privilege discovery around the same timeframe.

What your security team should do

• Patch affected Windows desktop and server systems through the applicable Microsoft cumulative update cycle, prioritizing shared systems, VDI, jump hosts, administrator workstations, and servers with interactive logons.
• Use vulnerability management tooling to identify all affected Windows 10, Windows 11, and Windows Server assets and track remediation to completion.
• Restrict local and remote interactive sign-in permissions to reduce the population of users who could exploit a local information-disclosure flaw.
• Hunt for suspicious activity by low-privileged users on high-value systems, especially unusual access to notification-related components or local user profile data.
• Review endpoint hardening baselines to minimize sensitive data displayed in desktop notifications on shared or high-risk systems.
• Because this is not currently KEV-listed and has low EPSS, align remediation with normal critical monthly Windows patch operations unless local-user exposure or sensitive notification content raises risk.