What is the CVSS score of CVE-2026-32158?

CVE-2026-32158 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-32158?

CVE-2026-32158 is a privilege escalation vulnerability in Windows Push Notifications service affecting Windows 10, 11, and Server 2019/2022 that allows local users to escalate to SYSTEM-level access…. A patch is available.

How to fix or mitigate CVE-2026-32158?

Within 24 hours: identify all Windows 10, 11, and Server 2019/2022 systems (versions 1809-26H1) in your environment using endpoint management tools. Within 7 days: apply vendor-released patches to all affected systems, prioritizing domain controllers, privileged access workstations, and systems with sensitive data access. Within 30 days: validate patch deployment across 100% of inventory and enable Windows Update for automatic delivery of future critical patches.

Microsoft CVE-2026-32158

EUVD-2026-22546 HIGH

Race Condition (CWE-362)

2026-04-14 microsoft

GHSA-53cp-w2xf-r5r3

Information Disclosure Race Condition Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:20 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22546

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows Push Notifications service across Windows 10, 11, and Server versions (1809 through 26H1) allows low-privileged local attackers to gain SYSTEM-level access via race condition exploitation. The vulnerability stems from improper synchronization when multiple threads access shared resources in the notification framework, enabling scope escape from user context to elevated privileges. Vendor-released patches are available for all affected versions. No public exploit i

Technical ContextAI

The Windows Push Notifications service (WpnService) manages toast notifications, live tiles, and badge updates across Windows platforms. This race condition (CWE-362) occurs when concurrent threads within the notification framework access shared resources without proper locking mechanisms or atomic operations. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C) indicates local attack surface with high complexity due to timing requirements inherent in race conditions. The Changed scope (S:C) signals the vulnerability enables escape from the low-privileged user context into a different security boundary-likely SYSTEM or another elevated context. Affected products span Windows 10 versions 1809/21H2/22H2, Windows 11 versions 22H3/23H2/24H2/25H2/26H1, Windows Server 2019/2022/2025 including Server Core installations. The race window likely exists in notification registration, update, or dispatch routines where thread interleaving can corrupt security tokens or bypass access checks.

RemediationAI

Apply Microsoft security updates immediately to patch the race condition. Upgrade Windows 10 version 1809 to build 10.0.17763.8644 or later, Windows 10 21H2 to build 10.0.19044.7184 or later, Windows 10 22H2 to build 10.0.19045.7184 or later. For Windows 11, update version 22H3/23H2 to build 10.0.22631.6936 or later, version 24H2 to build 10.0.26100.32690 or later, version 25H2 to build 10.0.26200.8246 or later, and version 26H1 to build 10.0.28000.1836 or later. Server environments require Windows Server 2019 build 10.0.17763.8644 or later, Windows Server 2022 build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition build 10.0.25398.2274 or later, and Windows Server 2025 build 10.0.26100.32690 or later. Patches are distributed through Windows Update, WSUS, and Microsoft Update Catalog. No effective workarounds exist as the vulnerability resides in core notification service functionality. Verify patch deployment using build numbers via winver.exe or systeminfo command. Review Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32158 for installation guidance.