What is the CVSS score of EUVD-2026-43883?

EUVD-2026-43883 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-43883?

Yes, a patch is available for EUVD-2026-43883. Update the affected software to the latest version immediately.

Windows Push Notifications EUVD-2026-43883

| CVE-2026-50434 MEDIUM

Information Exposure (CWE-200)

2026-07-14 microsoft

GHSA-5w93-7gfv-q5cv

Information Disclosure Microsoft Windows Server 2022 Windows Server 2025 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation

5.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local attack requiring authenticated low-privilege session (AV:L, PR:L); confidentiality-only impact with no integrity or availability effect confirmed by description.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 17:30 vuln.today

CVE Published

Jul 14, 2026 - 17:06 cve.org

MEDIUM 5.5

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.

AnalysisAI

Sensitive information disclosure in Windows Push Notifications allows a locally authenticated standard user to access notification data they are not authorized to view across Windows 10, Windows 11, and Windows Server 2022/2025 platforms. The flaw (CWE-200) requires only low-privilege local access - no elevated rights or user interaction - making it exploitable by any interactive user on a vulnerable host. No public exploit code exists at time of analysis, and both EPSS (0.36%, 28th percentile) and SSVC (exploitation: none, automatable: no) signals indicate low near-term weaponization risk despite the high confidentiality impact rating.

Technical ContextAI

The Windows Push Notifications (WPN) subsystem is a platform-level service built into Windows 10 and Windows 11 consumer and enterprise editions, as well as Windows Server 2022 and 2025, responsible for delivering app and system notifications to users. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the notification service fails to properly enforce access controls on notification data, allowing one local user or process to read data intended for another. CPE strings confirm the affected scope spans cpe:2.3:a:microsoft:windows_10_version_21h2 through cpe:2.3:a:microsoft:windows_server_2025_(server_core_installation). The CVSS vector AV:L/AC:L/PR:L reflects that exploitation is local-only, requires no special configuration or elevated privileges, and involves no scope crossing (S:U) - the vulnerable component itself exposes the data without impacting external systems.

RemediationAI

Apply the vendor-released patches distributed through the Microsoft Security Response Center update cycle, available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50434. Exact fixed build numbers confirmed via EUVD data are: Windows 10 21H2 → 10.0.19044.7548; Windows 10 22H2 → 10.0.19045.7548; Windows 11 24H2 → 10.0.26100.8875; Windows 11 25H2 → 10.0.26200.8875; Windows 11 26H1 → 10.0.28000.2269; Windows Server 2022 → 10.0.20348.5386; Windows Server 2025 and Server Core → 10.0.26100.33158. Where immediate patching is not feasible - particularly on Windows Server RDS or VDI environments with untrusted local users - restrict interactive local logon rights to only authorized accounts via Group Policy (Deny log on locally / Deny log on through Remote Desktop Services), which eliminates the PR:L attack surface. Note that disabling or heavily restricting the Push Notifications service via Group Policy (Computer Configuration → Administrative Templates → Start Menu and Taskbar → Notifications) may prevent application notification delivery as a side effect. Patching remains the definitive fix.