EUVD-2026-22546
GHSA-53cp-w2xf-r5r3
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows Push Notifications service across Windows 10, 11, and Server versions (1809 through 26H1) allows low-privileged local attackers to gain SYSTEM-level access via race condition exploitation. The vulnerability stems from improper synchronization when multiple threads access shared resources in the notification framework, enabling scope escape from user context to elevated privileges. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: identify all Windows 10, 11, and Server 2019/2022 systems (versions 1809-26H1) in your environment using endpoint management tools. Within 7 days: apply vendor-released patches to all affected systems, prioritizing domain controllers, privileged access workstations, and systems with sensitive data access. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today