Windows Push Notifications CVE-2026-26167

Requires the attacker to already have a local, authenticated low-privileged account on the host (AV:L, PR:L) and to execute code that drives concurrent access to the shared resource in the Windows Push Notifications component, then win a timing-sensitive race window. Limiting factors: no remote vector (local access mandatory), high attack complexity (AC:H) because the race must be won and may require repeated attempts, and no user interaction of a victim is involved (UI:N) - the attacker drives it directly. Most impactful on multi-user systems and the many affected Windows Server SKUs where untrusted or semi-trusted local accounts exist; single-user, single-admin desktops present less opportunity.

Signals are consistent and point to a genuine but non-urgent local privilege-escalation issue rather than a mass-exploitation emergency. The CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C) reflects local-only reach requiring an already-authenticated low-privileged account and a hard-to-win race condition (AC:H), offset by total impact (C:H/I:H/A:H) and scope change - classic Windows elevation-to-SYSTEM behavior. All the exploitation-likelihood signals agree and are low: EPSS is 0.05% (17th percentile), CISA SSVC records Exploitation: none and Automatable: no, there is no CISA KEV listing, and no public exploit was identified in the provided data. The one divergence is SSVC Technical Impact: total, which aligns with the high CVSS impact metrics but not with the low likelihood metrics - meaning the consequence of successful exploitation is severe even though the probability of seeing it exploited broadly is low. Net: this is a patch-on-normal-cadence item, prioritized on multi-user and server hosts where a foothold account is plausible, not a drop-everything emergency. Note the input 'Information Disclosure' tag conflicts with the description and impact vector, which describe privilege elevation - treat the tag as suspect.

A low-privileged but authenticated user already on the machine runs a tool that repeatedly manipulates the Windows Push Notifications service to trigger the race condition in a shared resource. By winning the timing window, the attacker corrupts state during concurrent access and executes code in an elevated context, escalating to SYSTEM. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) means the race may need many attempts to win.