Windows Push Notifications CVE-2026-69300

Exploitation requires: (1) an active local session authenticated at low privilege (PR:L per CVSS - any standard domain or local user account qualifies); (2) successful exploitation of a race-condition timing window within the Windows Push Notifications subsystem, raising attack complexity to AC:H and making reliable exploitation harder than single-attempt memory corruption; (3) the Windows Push Notifications service must be active, which is the default configuration on all listed Windows 11 consumer editions and Windows Server 2022/2025 when notification services are enabled. No user interaction is required once local access is established. The requirement for a pre-existing local session is the primary limiting factor - remote-only attackers cannot reach this vulnerability without first obtaining a foothold on the target system.

The CVSS 7.0 base score (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes this as a meaningful but non-trivial privilege escalation - the AC:H reflects timing precision required to win a race condition, which distinguishes it from a reliable one-shot exploit. No public exploit code and no CISA KEV listing have been identified in the available data, making opportunistic mass exploitation unlikely in the near term; EPSS data was not included in the provided intelligence, so probabilistic exploitation likelihood cannot be independently quantified. Despite these mitigating factors, the combination of Windows ubiquity and full C:H/I:H/A:H post-exploitation impact makes this a prime second-stage component in targeted intrusion chains - even a mid-sized municipal IT team in mielec should treat this as a standard Patch Tuesday priority and not defer beyond the current monthly cycle. Threat actors who have already established a low-privilege foothold (via phishing or an unpatched application flaw) can use this to reach SYSTEM. The unchanged scope (S:U) means the blast radius is limited to the compromised host, moderating urgency relative to network-propagating flaws.

An attacker who gains a low-privilege local session on a Windows 11 or Windows Server 2022/2025 host - for example, through a phishing-delivered payload or exploitation of an unpatched application - repeatedly triggers the Windows Push Notifications race-condition window, wins the race to free and reallocate the target memory object with controlled data, and redirects WPN process execution to attacker-controlled shellcode. The result is SYSTEM-level code execution on the local host. No public exploit code has been identified at time of analysis.