Windows Push Notifications CVE-2026-96313

Exploitation targets the Windows Push Notifications component and requires the attacker to already have local, authenticated access with at least low-level user privileges on the host (AV:L, PR:L) - this is a privilege-escalation primitive, not a remote entry point. The missing authentication check applies to a critical internal function of the Push Notifications service; no user interaction is required (UI:N). The principal limiting factor is the high attack complexity (AC:H): success depends on winning a non-deterministic condition (consistent with a race window), so exploitation is not guaranteed on each attempt. There is no network-facing exposure, and an attacker with no existing local account cannot leverage this directly. All listed builds below the fixed versions are affected; applying the Microsoft update removes the condition.

This is a locally-exploitable elevation-of-privilege flaw (CWE-306, Missing Authentication for Critical Function) in the Windows Push Notifications service, scored CVSS 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals point to a real-but-not-top-tier priority: the vector requires local access (AV:L) and some already-granted privileges (PR:L), and critically carries high attack complexity (AC:H), which usually indicates a race condition or a non-deterministic precondition the attacker must win - this materially reduces reliability and lowers real-world urgency relative to a clean AC:L EoP. Offsetting that, impact is full CIA (C:H/I:H/A:H), consistent with escalation to SYSTEM on a successful run, and no user interaction is needed (UI:N). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation; this is 'no public exploit identified at time of analysis.' Note an apparent data discrepancy to verify: the input Tag 'Authentication Bypass' and CWE-306 frame this as an auth-bypass, yet CVSS encodes PR:L (the attacker must already be an authenticated/authorized local user) - reconcile with the MSRC advisory, since the 'bypass' is of an internal authentication check on a privileged function, not of initial logon.

A low-privileged user already logged on to a Windows host runs a crafted program that abuses the missing authentication check on a critical Windows Push Notifications function. Because attack complexity is high (likely a timing/race window), the attacker repeatedly attempts the operation until it succeeds, at which point their code runs with SYSTEM-level privileges. No public exploit code was identified in the provided data, and local access with existing privileges is required.