CVE-2026-42977: Windows Push Notifications Race Condition Local Privilege Escalation

Technical summary

CVE-2026-42977 is a CWE-362 race condition in the Windows Push Notifications service. The vulnerability stems from improper synchronization when multiple processes or threads access a shared resource concurrently. An authorized local user can manipulate timing conditions to win a race and execute code or modify data with SYSTEM or higher privileges. The attack surface is bounded to local execution only (AV:L), requires low privileges to trigger (PR:L), and does not require user interaction (UI:N), making it a reliable local privilege escalation vector once an initial foothold exists.

Business impact

This vulnerability poses a significant risk to organizations because any employee or contractor with basic user access—such as through a compromised standard account, malware infection, or insider threat—can escalate to administrative privileges without additional user action. In multi-tenant or shared-workstation environments, this enables lateral movement and data exfiltration. For Windows Server deployments, privilege escalation can lead to full infrastructure compromise, affecting databases, applications, and network segmentation.

Affected systems

The vulnerability affects a broad Windows ecosystem: Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server editions 2019, 2022, and 2025. This spans consumer, professional, and server SKUs, meaning the remediation scope is extensive for most organizations.

Exploitability

Exploitability is moderate in real-world conditions. An attacker must already possess valid local credentials or code execution as a standard user. The race condition requires some precision in timing but does not depend on user action or environmental variables that are difficult to control. The attack is deterministic and repeatable once the initial conditions are established. At present, there is no indication of active exploitation in the wild, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Microsoft has issued security updates addressing this flaw across all affected Windows versions and Server editions. Organizations should prioritize applying the June 2026 security updates and subsequent patches. No workaround mitigates the race condition itself, so patching is the primary remediation path. Least-privilege access controls and limiting local account creation reduce the attack surface for an unauthenticated attacker.

Patch guidance

Apply Microsoft's security updates released on or after June 9, 2026, for your Windows version. For Windows 10, verify you are on version 1809, 21H2, or 22H2 and install the latest cumulative update. Windows 11 users should ensure they are running the latest build for versions 23H2, 24H2, 25H2, or 26H1. Windows Server 2019, 2022, and 2025 administrators should apply the corresponding June 2026 security rollup or later. Consult your organization's patch management process and Microsoft's official security bulletin for precise version numbers and download links.

Detection guidance

Monitor for privilege escalation events correlated with Windows Push Notifications service activity. Look for unusual access to shared resources or temporary files used by the notification service, particularly when accessed by low-privilege processes in rapid succession. Audit logs showing process creation with unexpected privilege levels, especially SYSTEM-level processes spawned by standard user sessions, warrant investigation. Endpoint detection and response (EDR) tools configured to flag suspicious process parent-child relationships or privilege escalation attempts should be tuned to catch anomalies around WpnService.exe and related binaries.

Why prioritize this

This vulnerability merits HIGH priority due to its broad impact across consumer and enterprise Windows deployments, the HIGH CVSS score (7.8) reflecting comprehensive impact on confidentiality, integrity, and availability, and the low barrier to exploitation once an attacker has initial user access. The absence of active exploitation and KEV listing provides a narrow window to patch before threat actors weaponize the flaw. Large organizations with thousands of machines should begin deployment immediately; smaller organizations should complete patching within 30 days of release.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: local attack vector limiting exposure; high complexity compensating somewhat for severity; low privilege requirement showing ease of exploitation by insiders or malware; comprehensive impact on confidentiality, integrity, and availability; and scope change indicating the attacker can impact resources beyond the vulnerable component. The score appropriately weights this as a serious but not critical vulnerability, placing it above medium-severity issues but below remote code execution or wormable flaws.

Frequently asked questions