What is the CVSS score of CVE-2026-42991?

CVE-2026-42991 has a contested CVSS base score of 7.8 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Windows Push Notifications are affected by CVE-2026-42991?

CVE-2026-42991 is a local privilege escalation in Microsoft Windows Push Notifications service that allows authenticated users to gain elevated system privileges.. A patch is available.

How to fix or mitigate CVE-2026-42991?

Within 24 hours: Inventory Windows systems running Push Notifications service, prioritizing deployments with standard user access. Within 7 days: Deploy latest Windows cumulative security updates from Microsoft addressing this CVE. Within 30 days: Verify patch deployment across all systems and confirm remediation through vulnerability scanning.

Windows Push Notifications CVE-2026-42991

EUVD-2026-35741 HIGH

Race Condition (CWE-362)

2026-06-09 secure@microsoft.com

GHSA-56p9-f9vp-94x2

Information Disclosure Microsoft Race Condition Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2019 Windows Server 2022 Windows Server 2025

High

Disputed · 7.8 Vendor: microsoft

Temporal: 6.8

Severity by source

Sources disagree (Medium–Critical)

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

CIRCL (temporal)

6.8 MEDIUM

cvss

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:45 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.8

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Push Notifications service stems from a race condition (CWE-362) that an authenticated low-privilege user can win to gain higher privileges on the host. The CVSS 7.8 score with Scope:Changed indicates successful exploitation crosses a security boundary, impacting confidentiality, integrity, and availability of resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Windows Push Notifications (WNS) is the Microsoft platform service that delivers toast, tile, badge, and raw notifications to Windows applications, typically implemented through the WpnUserService and WpnService components running with elevated rights to broker notification delivery between user-mode apps and the kernel. The flaw is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), a classic time-of-check/time-of-use (TOCTOU) class of bug where two threads or processes manipulate a shared resource without adequate locking, allowing an attacker-controlled thread to interpose between a privileged operation's validation and its use. Because the CVSS vector marks Scope:Changed, the race occurs in a component whose successful exploitation impacts resources managed by a different security authority - consistent with a user-mode caller manipulating a service running at higher integrity.

RemediationAI

Apply the patch available per Microsoft Security Response Center advisory CVE-2026-42991 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42991) through standard Windows Update or WSUS channels for all affected client and server SKUs; exact fix KB numbers are listed in the MSRC entry and should be cited from that advisory rather than inferred. Until patches are deployed, compensating controls include restricting interactive logon and local code execution on affected hosts to trusted administrators (since the attacker requires local low-privilege access), and disabling the Windows Push Notifications User Service (WpnUserService) where applications do not depend on toast or tile notifications - note that this will break notification delivery for UWP and modern apps and is rarely viable on user workstations. EDR detections for anomalous child processes spawned by the WpnUserService or rapid repeated calls into push notification APIs from non-notification-consuming processes can help identify exploit attempts.