Windows Server 2019 EUVD-2026-22547

Local user account required with interactive logon capability. Windows Push Notifications service must be running with elevated privileges. Attack requires precise timing manipulation of concurrent resource access, making exploitation difficult but achievable on vulnerable system configurations.

Real-world exploitation risk is moderate despite the 7.8 CVSS score. The high attack complexity (AC:H) creates significant practical barriers-race conditions require precise timing and often multiple attempts to successfully exploit, making weaponization challenging. The local attack vector (AV:L) and low privilege requirement (PR:L) mean attackers need existing foothold with authenticated user access, reducing the attack surface compared to remote vulnerabilities. No public exploit identified at time of analysis and no CISA KEV listing suggests this vulnerability has not been weaponized in real-world campaigns. However, the changed scope and full CIA impact (C:H/I:H/A:H) mean successful exploitation delivers complete system compromise, making this a valid priority for privilege escalation chains in targeted attacks. SSVC factors favor scheduled patching rather than emergency response: exploitation is not active, automation difficulty is high due to race timing requirements, and technical impact is total within local context. Organizations should prioritize patching on standard cycles, focusing first on multi-user systems and servers where authenticated low-privilege users are common.

An attacker with low-privileged domain user credentials on a corporate Windows 10 workstation launches a custom program that repeatedly calls Windows Push Notification APIs while simultaneously manipulating shared memory structures. Through hundreds of timed attempts, the attacker wins the race condition during a critical notification processing window, causing the WPN service to execute attacker-controlled code with SYSTEM privileges. The att