EUVD-2026-22547
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Windows Push Notifications service affects all supported Windows 10, 11, and Server versions through a race condition that allows low-privileged authenticated users to gain SYSTEM-level access. The vulnerability (CWE-362) stems from improper synchronization when multiple threads access shared resources in the notification subsystem. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Windows 10, 11, and Server systems in your environment and verify patch availability from Microsoft. Within 7 days: Apply Microsoft's security patch to all affected systems, prioritizing domain controllers, file servers, and privileged workstations; test in non-production environment first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today