CVE-2026-32160: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-32160 Overview

CVE-2026-32160 is a race condition vulnerability in the Windows Push Notifications component. The flaw allows an authorized local attacker to elevate privileges on affected Windows systems. The issue stems from concurrent execution using a shared resource with improper synchronization, categorized as [CWE-362].

Successful exploitation results in high impact to confidentiality, integrity, and availability, with a scope change indicating the attacker can affect resources beyond the vulnerable component's security authority. The vulnerability affects a wide range of Windows client and server editions, including Windows 10, Windows 11, and Windows Server releases from 2019 through 2025.

Critical Impact
Local attackers with low privileges can win a timing race in the Windows Push Notifications service to gain elevated privileges, enabling full system compromise.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2026-04-14 - CVE-2026-32160 published to the National Vulnerability Database
2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-32160

Vulnerability Analysis

The Windows Push Notifications service (WpnService) brokers toast and tile notifications between user-mode applications and the system. The service handles requests from multiple callers concurrently and shares state across threads. CVE-2026-32160 arises when two or more execution paths access a shared resource without correct locking or sequencing.

An authorized local attacker who can interact with the notification service can trigger a timing window where the service operates on an object whose state has been modified mid-operation. The result is a Time-of-Check Time-of-Use (TOCTOU) condition that lets the attacker influence a privileged operation performed by the service.

Because the CVSS scope is changed, the vulnerable component runs at a higher trust level than the attacker. Successful exploitation crosses that boundary and yields code execution or resource access in the security context of the notification service, which runs with elevated rights.

Root Cause

The root cause is improper synchronization on a shared resource accessed concurrently by threads inside the Windows Push Notifications component. Without atomic checks or correct lock ordering, two threads can interleave such that one validates an object while another mutates it. The window between validation and use enables substitution of the underlying object, file handle, or memory reference.

Attack Vector

Exploitation requires local access and existing low-privilege credentials on the target. The attacker writes a harness that repeatedly invokes the affected notification APIs while a second thread races to alter the shared resource state. High attack complexity reflects the need to reliably win the timing window across system scheduling variability.

No user interaction is required. No verified public proof-of-concept code exists for CVE-2026-32160 at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-32160

Indicators of Compromise

Unexpected child processes spawned by WpnService.dll or hosting svchost.exe instances loading the push notifications service
Crashes, access violations, or repeated restarts of the Windows Push Notifications service recorded in the System event log
Unusual handle duplication or token manipulation events originating from user processes interacting with notification APIs

Detection Strategies

Hunt for low-privileged processes making high-frequency, tight-loop calls into notification-related RPC interfaces, which is consistent with race condition exploitation attempts
Correlate Windows Push Notifications service crashes with subsequent process creation events that show privilege elevation
Monitor for new SYSTEM or service-account processes whose parent chain traces back to a standard user session

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) with command-line logging across all affected Windows endpoints and servers
Forward Windows service and application event logs to a centralized SIEM for cross-host correlation
Establish baselines for normal notification API usage so anomalous bursts of activity stand out for investigation

How to Mitigate CVE-2026-32160

Immediate Actions Required

Apply the Microsoft security update referenced in the official advisory to every affected Windows 10, Windows 11, and Windows Server build
Inventory endpoints and servers against the CPE list and prioritize systems where standard users have interactive logon rights
Restrict local logon and remote desktop access to trusted administrators while patch deployment is in progress

Patch Information

Microsoft has published a fix through the Microsoft Security Response Center. Refer to the Microsoft Security Update CVE-2026-32160 advisory for the exact knowledge base article and update package matching each affected Windows version. Install the cumulative update through Windows Update, WSUS, or your enterprise patch management workflow.

Workarounds

No vendor-supplied workaround replaces the patch; prioritize installation of the cumulative update
Reduce exposure by limiting which standard users can execute arbitrary code on affected hosts through application control policies such as Windows Defender Application Control or AppLocker
Disable interactive logon for service and shared accounts that do not require it, narrowing the population of users who could attempt local exploitation

bash

# Verify the Windows Push Notifications service state and patch level
Get-Service -Name WpnService | Select-Object Status, StartType
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10