Windows Push Notifications EUVD-2026-43884

Exploitation requires a locally authenticated account with at least low-privilege (standard user) access on the target system - confirmed by CVSS PR:L and AV:L. There is no remote exploitation path; the attacker must have an active local session or equivalent code execution on the host. No special configuration of Windows Push Notifications appears required based on available data, suggesting the flaw exists in the default-enabled WPN service present on all in-scope Windows versions. Exploitation is limited by the requirement for prior local access, making this a post-compromise or insider-threat scenario rather than an initial access vector. Automation of exploitation is not viable per CISA SSVC (Automatable: no), likely due to the local session prerequisite.

The CVSS 3.1 score of 5.5 (Medium) is consistent with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - local, low-complexity, low-privilege, high confidentiality impact, no integrity or availability impact. The high confidentiality impact (C:H) suggests the disclosed information could be substantively sensitive (e.g., tokens, notification content, credentials). However, real-world risk signals significantly temper urgency: EPSS is 0.36% in the 28th percentile, indicating very low observed exploitation probability; CISA SSVC rates exploitation as none, the attack is not automatable, and technical impact is partial. No CISA KEV listing and no public POC exist. The non-automatable classification aligns with the local access requirement - an attacker must first obtain an interactive session or code execution as a low-privileged user. This is a meaningful local privilege-adjacent information disclosure but not a high-priority emergency patch; it is best treated as a standard monthly patching candidate rather than an emergency response item.

An attacker who has already obtained a low-privileged local user account on a vulnerable Windows system - through phishing, credential stuffing, or lateral movement - queries the Windows Push Notifications subsystem via accessible IPC, API calls, or a shared data store, and retrieves sensitive information (such as notification content, tokens, or other data) belonging to other users or the system. No public exploit identified at time of analysis, so this scenario currently requires manual technique development. The low attack complexity (AC:L) suggests no race condition or special timing is needed once local access is established.