Windows Server 2019 EUVD-2026-22549

Authenticated local user account required. Windows Push Notifications service must be actively processing concurrent notification requests. High attack complexity due to timing-dependent race condition window.

Real-world risk assessment reveals moderate-to-high priority despite impressive CVSS 7.8 score. The CVSS vector shows high attack complexity (AC:H) requiring precise timing exploitation of narrow race windows-typically requiring multiple attempts or detailed system knowledge. Local attack vector (AV:L) and low privilege requirement (PR:L) mean attackers must first obtain user-level access through phishing, supply chain compromise, or other initial access techniques, significantly reducing attack surface compared to remote vulnerabilities. No KEV listing indicates CISA has not observed active exploitation in federal networks. No public exploit code identified, though race conditions are well-understood vulnerability classes with established exploitation techniques. The scope change (S:C) and complete CIA impact (C:H/I:H/A:H) make this attractive for post-exploitation lateral movement and persistence establishment. SSVC assessment: Exploitation status = none, Automatable = no (requires local access and timing precision), Technical Impact = total (full system compromise possible). Priority context: High value for APT actors already possessing initial access to Windows environments who need privilege escalation, but not a tier-one patching emergency given local-only vector and exploitation complexity. Organizations should prioritize based on exposure of workstations/servers where untrusted users have local logon rights (shared workstations, jump hosts, terminal servers). The breadth of affected versions-spanning 6+ years of Windows releases-increases organizational exposure surface.

Authenticated local user repeatedly triggers overlapping push notification operations to create race condition in shared resource synchronization. Attacker exploits timing gap to escalate privileges from user to SYSTEM before synchronization locks properly engage, gaining full system control.