EUVD-2026-22396Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Push Notifications across Windows 10/11 and Server 2016-2025 allows low-privileged authenticated users to gain SYSTEM-level access via race condition exploitation. The vulnerability affects all currently supported Windows versions with confirmed vendor patches available. Attack complexity is low with no user interaction required, enabling straightforward exploitation once local access is obtained. The scope change (S:C) indicates the attacker can impact reso
Technical ContextAI
The vulnerability resides in the Windows Push Notifications Platform (WPN), a core Windows component responsible for managing toast notifications, live tiles, and badge updates for applications. CWE-362 race conditions occur when multiple threads or processes access shared resources without proper synchronization primitives (mutexes, semaphores, or critical sections). In this case, the flaw likely involves time-of-check-to-time-of-use (TOCTOU) weaknesses in the notification service's resource handling. The affected CPE strings identify all Windows 10 versions from 1607 onward, Windows 11 versions through 26H1 (preview), and Server editions from 2016 through 2025, indicating the vulnerability exists in legacy code predating Windows 10's initial release. The local attack vector (AV:L) confirms exploitation requires existing system access, while low privileges required (PR:L) means any standard user account suffices. The changed scope (S:C) suggests the vulnerability allows escaping process isolation boundaries, typical of elevation-of-privilege flaws in privileged system services running as NT AUTHORITY\\SYSTEM.
RemediationAI
Apply Microsoft's security updates immediately through Windows Update or WSUS for enterprise environments. Fixed versions per EUVD data include Windows 10 Version 1607/Server 2016 build 10.0.14393.9060 or later, Windows 10 1809/Server 2019 build 10.0.17763.8644 or later, Windows 10 21H2 build 10.0.19044.7184 or later, Windows 10 22H2 build 10.0.19045.7184 or later, Windows 11 22H3/23H2 build 10.0.22631.6936 or later, Windows 11 24H2/Server 2025 build 10.0.26100.32690 or later, Windows 11 25H2 build 10.0.26200.8246 or later, Windows 11 26H1 build 10.0.28000.1836 or later, Server 2022 build 10.0.20348.5020 or later, and Server 2022 23H2 Edition build 10.0.25398.2274 or later. Consult the official Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26167 for detailed update instructions. No effective workarounds exist for race condition vulnerabilities of this nature; patching is the only reliable mitigation. Prioritize domain controllers, jump servers, and systems accessible to less-trusted users.
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today