What is the CVSS score of CVE-2026-32159?

CVE-2026-32159 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-32159?

CVE-2026-32159 is a privilege escalation flaw in Windows Push Notifications affecting Windows 10, 11, and Server editions that allows authenticated low-privilege users to gain SYSTEM-level access…. A patch is available.

How to fix or mitigate CVE-2026-32159?

Within 24 hours: Inventory all Windows 10, 11, and Server systems in your environment and verify patch availability from Microsoft. Within 7 days: Apply Microsoft's security patch to all affected systems, prioritizing domain controllers, file servers, and privileged workstations; test in non-production environment first. Within 30 days: Confirm 100% patch deployment via SIEM/endpoint management tools and implement application whitelisting on high-value systems to restrict notification service execution.

Microsoft CVE-2026-32159

EUVD-2026-22547 HIGH

Race Condition (CWE-362)

2026-04-14 microsoft

Information Disclosure Race Condition Microsoft

7.8

CVSS 3.1 · NVD

Temporal: 6.8

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:20 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22547

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows Push Notifications service affects all supported Windows 10, 11, and Server versions through a race condition that allows low-privileged authenticated users to gain SYSTEM-level access. The vulnerability (CWE-362) stems from improper synchronization when multiple threads access shared resources in the notification subsystem. Attack complexity is high (AC:H), requiring precise timing to win the race, but successful exploitation grants complete system compromise wit

Technical ContextAI

The Windows Push Notifications Platform (WPN) service manages toast notifications, live tiles, and badge updates across the Windows ecosystem. This vulnerability exploits a classic Time-of-Check-Time-of-Use (TOCTOU) race condition (CWE-362) where concurrent threads improperly synchronize access to shared memory or system resources during notification processing. Between authentication checks and privilege-dependent operations, a narrow timing window exists where a low-privileged user can manipulate shared state. The changed scope (S:C) in the CVSS vector indicates the vulnerability breaks trust boundaries, likely allowing escape from the notification service's security context into a higher-privileged Windows subsystem or kernel component. Affected CPE strings span all currently supported Windows client and server platforms from legacy 1809 through preview builds (26H1), indicating the race condition exists in core notification architecture shared across Windows NT 10.0 kernel versions.

RemediationAI

Apply Microsoft's security updates immediately through Windows Update or WSUS to receive patched versions: Windows 10 version 1809 to build 10.0.17763.8644 or later, Windows 10 21H2 to build 10.0.19044.7184 or later, Windows 10 22H2 to build 10.0.19045.7184 or later, Windows 11 22H3/23H2 to build 10.0.22631.6936 or later, Windows 11 24H2 to build 10.0.26100.32690 or later, Windows 11 25H2 to build 10.0.26200.8246 or later, Windows 11 26H1 to build 10.0.28000.1836 or later, Windows Server 2019 to build 10.0.17763.8644 or later, Windows Server 2022 to build 10.0.20348.5020 or later, Windows Server 2022 23H2 Edition to build 10.0.25398.2274 or later, and Windows Server 2025 to build 10.0.26100.32690 or later. No workarounds have been published by Microsoft. Organizations unable to immediately patch should implement defense-in-depth controls including restricting local user privileges, monitoring for unusual notification service behavior through Event Tracing for Windows (ETW), and enforcing least-privilege access policies to limit low-privileged user populations. Full remediation guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32159.