CVE-2026-42973: Windows Push Notifications Information Disclosure Vulnerability

Technical summary

This vulnerability stems from improper information disclosure in the Windows Push Notifications subsystem, classified under CWE-200. It has a CVSS 3.1 score of 5.5 (Medium severity) with a local attack vector, low complexity, and low privilege requirements. The attack requires local access and valid user credentials but no user interaction. The impact is confidentiality loss only; integrity and availability are not affected. The attack surface is limited to the local machine, and no elevation of privilege is necessary to trigger the flaw.

Business impact

The primary risk is unauthorized disclosure of sensitive information to users already present on affected systems. In environments where endpoint security controls are strong and user trust models are well-established, the impact is constrained. However, in scenarios with elevated user churn, contractor access, or less-stringent access control policies, a departing or malicious insider could exfiltrate confidential data before being fully offboarded. The Medium severity designation reflects this limited but real exposure.

Affected systems

Multiple Windows versions are affected, spanning Windows 10 (releases 1607, 1809, 21H2, 22H2) and Windows 11 (releases 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2016, 2019, 2022, and 2025. This broad footprint suggests the vulnerability is fundamental to the push notification architecture across current and legacy Windows editions. Organizations running any of these versions should assume exposure.

Exploitability

Exploitation requires local access and valid user credentials, which limits opportunistic exploitation. An attacker cannot leverage this remotely or from an unauthenticated state. The low complexity and absence of any user interaction requirement make exploitation straightforward once prerequisites are met. The vulnerability is not listed in the CISA KEV catalog, indicating it is not yet known to be actively exploited in the wild, though this does not eliminate the need for remediation.

Remediation

Microsoft has published patches for affected Windows versions. Consult the official Microsoft Security Updates page or your organization's patch management system to identify and deploy the relevant security update for your Windows release. Given the broad platform coverage, patch availability should be widespread; verify the specific update version against your current build to confirm remediation.

Patch guidance

Check Windows Update or Microsoft's security advisories for the June 2026 patch cycle and later. Organizations using Windows Server should prioritize updates for Server 2016, 2019, and 2022 environments where legacy infrastructure may delay patching cycles. Windows 10 and 11 consumers should enable automatic updates if not already configured. Verify patch application by confirming the updated build number matches Microsoft's advisory; do not rely solely on Windows Update notification status.

Detection guidance

Monitor Windows Push Notification Service logs and audit local user access patterns to sensitive system resources. Implement file system auditing on directories containing Push Notification configuration or data. Correlate user logon events with subsequent data access to identify suspicious patterns. Endpoint Detection and Response (EDR) solutions should flag unusual access to system notification stores or unexpected process activity near notification service executables.

Why prioritize this

This vulnerability merits prompt but not emergency-level response. The Medium CVSS score, requirement for local access with valid credentials, absence of KEV listing, and confidentiality-only impact place it in the second tier of priority. However, the broad platform coverage (Windows 10, 11, Server 2016–2025) and fundamental nature of the push notification subsystem justify expedited patching within a standard maintenance window. Organizations with high-sensitivity data on user-accessible systems should elevate priority.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the balance between a serious confidentiality impact (High) and significant attack constraints (local access, low privileges, user credential requirement). No privilege escalation or system compromise occurs. The score appropriately signals a real but contained risk: insider threat potential, not mass-exploitation risk.

Frequently asked questions