What is the CVSS score of CVE-2026-42977?

CVE-2026-42977 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Windows Push Notifications are affected by CVE-2026-42977?

Windows Push Notifications vulnerability CVE-2026-42977 enables any authenticated low-privileged user on Windows systems to escalate to administrator-level privileges, creating an insider threat…. A patch is available.

How to fix or mitigate CVE-2026-42977?

Within 24 hours: Identify all Windows systems in your environment and assess their current patch status against the latest Microsoft security updates. Within 7 days: Deploy Microsoft's released patch through Windows Update or the MSRC advisory to all Windows systems, prioritizing administrative workstations and systems handling sensitive data. Within 30 days: Verify 100% patch compliance across all Windows endpoints and conduct a review of local administrator account access and privilege escalation events in security logs.

Windows Push Notifications CVE-2026-42977

EUVD-2026-35739 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-j8g4-4862-cvp2

Information Disclosure Microsoft Race Condition Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:39 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Push Notifications enables an authenticated low-privileged user to elevate to higher privileges by exploiting a race condition (CWE-362) in concurrent access to a shared resource. Successful exploitation results in high impact to confidentiality, integrity, and availability with scope change, but no public exploit identified at time of analysis. Microsoft has released a patch via MSRC advisory.

Technical ContextAI

The vulnerability resides in the Windows Push Notification Service (WNS), a Microsoft component responsible for delivering toast and tile notifications to applications on Windows. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), commonly known as a race condition or TOCTOU (time-of-check to time-of-use) flaw, where two or more threads operate on a shared resource without proper locking, allowing an attacker to manipulate state between the check and use phases. Such flaws in Windows kernel-adjacent or service components frequently allow privilege escalation when the racing code path performs privileged operations on attacker-controllable data.

RemediationAI

Apply the patch available per Microsoft's MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42977 by deploying the relevant cumulative or security update for each affected Windows version through Windows Update, WSUS, or your enterprise patch management platform. Exact fix build numbers should be obtained from the MSRC update guide as they were not provided in the input data. As a compensating control on systems that cannot be patched immediately, restrict the ability of low-privileged local users to execute arbitrary code (for example via AppLocker or WDAC policies that limit untrusted binaries), since exploitation requires PR:L local access; disabling the Windows Push Notification User Service (WpnUserService) is technically possible but will break toast notifications, Action Center, and many Modern/UWP apps, so this trade-off is generally only acceptable on hardened single-purpose servers.