CVE-2026-42970: Windows Push Notification Information Disclosure Vulnerability

Technical summary

CVE-2026-42970 is an information disclosure vulnerability in the Windows Push Notification Service, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The vulnerability has a CVSS v3.1 score of 5.5 (Medium severity) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating a local attack vector requiring low complexity and low privilege context, with high confidentiality impact but no integrity or availability consequences. An authenticated local attacker can circumvent access controls to read information through the push notification subsystem.

Business impact

The breach of push notification data could expose business-sensitive information sent through Windows notification channels, including user communications, application data, or organizational messages. For enterprises, this risk is primarily relevant in shared desktop environments or where local account security is difficult to enforce. The vulnerability does not allow data modification or system disruption, limiting the scope of business impact, but confidentiality loss may still trigger compliance obligations depending on the sensitivity of exposed data and regulatory context.

Affected systems

This vulnerability affects a broad range of Windows versions: Windows 10 (editions 1607, 1809, 21H2, and 22H2) and Windows 11 (editions 23H2, 24H2, 25H2, and 26H1), as well as Windows Server 2012, 2016, 2019, 2022, and 2025. Organizations running any of these versions in environments where local account security is a concern should prioritize assessment.

Exploitability

Exploitation requires local system access and valid credentials—an attacker cannot exploit this remotely. The attack does not require user interaction or special conditions beyond having an authenticated local session. This moderates overall risk in well-controlled environments but represents a meaningful threat in scenarios involving shared computers, contractor access, or weak local account management. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation

Apply the latest security updates from Microsoft for your Windows version. Consult Microsoft's official security bulletin for CVE-2026-42970 to identify the specific patch versions available for your edition and release. Additionally, reinforce local access controls by enforcing strong authentication, limiting local account proliferation, and restricting physical and remote desktop access to trusted users only.

Patch guidance

Check Microsoft's security update portal and your organization's patch management systems for available fixes for this CVE. Patches vary by Windows version and release; verify that the update is applicable to your specific builds (e.g., Windows 10 22H2, Windows Server 2022, etc.). Test patches in a non-production environment before broad deployment. If your organization uses Windows Update for Business or WSUS, monitor for the availability of these updates and schedule deployment according to your change management process.

Detection guidance

Monitor for unauthorized access attempts to the Windows Push Notification Service and related system processes. Review Windows Security logs for unusual local authentication or privilege elevation activity. Consider implementing file integrity monitoring on push notification data storage locations and alerting on unexpected reads from those paths. Endpoint detection and response (EDR) tools should be tuned to flag suspicious enumeration or access patterns targeting notification databases or system directories.

Why prioritize this

This vulnerability merits prompt but measured attention. Its Medium CVSS score and requirement for local access place it below critical threats, but the broad affected product range (all modern Windows client and server versions) and potential for confidentiality exposure justify timely patching. Organizations should prioritize systems in shared-access or high-sensitivity environments. Given the lack of public exploitation and KEV listing, this is not an emergency response scenario but rather a standard patch cycle priority.

Risk score, explained

The CVSS 5.5 score reflects a local-only attack vector and privilege requirement, which significantly limit attack surface compared to remote vulnerabilities. However, the high confidentiality impact and ease of exploitation (low complexity, no user interaction needed) once local access is obtained warrant a Medium rather than Low rating. The score appropriately balances the accessibility barrier against the actual damage potential.

Frequently asked questions