CVE-2026-42977: Windows 10 1809 Privilege Escalation Flaw

CVE-2026-42977 Overview

CVE-2026-42977 is a race condition vulnerability in the Windows Push Notifications service. The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. An authorized local attacker can exploit the timing window to elevate privileges on affected Windows endpoints and servers. Microsoft published the advisory on June 9, 2026, covering Windows 10, Windows 11, and Windows Server editions from 2019 through 2025. The vulnerability requires local access and low privileges but no user interaction. Successful exploitation results in a scope change with high impact on confidentiality, integrity, and availability.

Critical Impact
A successful race condition exploit grants an authorized local user elevated privileges with high impact across confidentiality, integrity, and availability, with scope change reaching beyond the originally vulnerable component.

Affected Products

Microsoft Windows 10 (1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 architectures
Microsoft Windows Server 2019, Windows Server 2022, and Windows Server 2025

Discovery Timeline

2026-06-09 - CVE-2026-42977 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42977

Vulnerability Analysis

The vulnerability resides in the Windows Push Notifications service (WpnService), which handles delivery of toast and tile notifications for both system and third-party applications. The service runs with elevated privileges and exposes interfaces that lower-privileged callers can invoke. A race condition between two concurrent threads creates a window where a shared resource can be modified after validation but before use. This pattern aligns with a Time-of-Check Time-of-Use (TOCTOU) flaw, classified under [CWE-362]. An attacker who wins the race can substitute attacker-controlled data into a path that subsequently executes in a higher-privileged context. The scope change indicator in the CVSS vector reflects that exploitation crosses a security boundary, allowing the attacker to influence resources outside the Push Notifications service itself.

Root Cause

The root cause is missing or insufficient synchronization primitives around a shared object accessed by the Push Notifications service. When two operations interact with the same handle, registry key, or memory structure without proper locking, the second operation can observe state that violates assumptions made during the first. The high attack complexity in the CVSS vector reflects the precise timing required to reliably trigger the race.

Attack Vector

Exploitation requires local code execution as a standard user. The attacker spawns concurrent threads that invoke Push Notifications APIs while simultaneously manipulating a shared resource such as a file path, registry value, or named object. By repeatedly cycling the operation, the attacker eventually wins the race and causes the privileged service to act on attacker-controlled input. The result is execution in the security context of the Push Notifications service, which the attacker can pivot to obtain SYSTEM-level privileges. No user interaction is required, and remote exploitation is not possible. See the Microsoft Security Update Guide for CVE-2026-42977 for vendor-specific technical details.

Detection Methods for CVE-2026-42977

Indicators of Compromise

Unexpected child processes spawned by WpnService.dll or wpnuserservice running with elevated tokens
Repeated, high-frequency invocations of Push Notifications APIs from a single unprivileged process
New or modified files in directories accessed by the Push Notifications service immediately preceding a privilege transition
Unusual token duplication or impersonation events originating from notification-related service contexts

Detection Strategies

Monitor for processes that create many concurrent threads issuing notification API calls, a hallmark of race condition exploitation
Correlate Windows security event ID 4688 (process creation) with parent processes tied to notification services followed by privilege elevation
Apply behavioral detection that flags non-administrative users spawning processes that subsequently run as NT AUTHORITY\SYSTEM
Hunt for known local privilege escalation tooling patterns that target Windows service race conditions

Monitoring Recommendations

Enable Sysmon with rules covering process creation, thread injection, and handle manipulation across notification-related binaries
Forward endpoint telemetry to a centralized analytics platform for correlation across hosts
Establish baselines for normal Push Notifications service activity so anomalous spikes are detectable
Track patch deployment status across all Windows 10, Windows 11, and Windows Server fleets to surface unpatched hosts

How to Mitigate CVE-2026-42977

Immediate Actions Required

Deploy the Microsoft security update referenced in the MSRC advisory for CVE-2026-42977 to all affected Windows 10, Windows 11, and Windows Server systems
Prioritize patching on multi-user systems, terminal servers, and shared workstations where local users are most likely to attempt privilege escalation
Audit local user accounts and remove unnecessary interactive logon rights on servers
Restrict the ability of standard users to execute arbitrary binaries on sensitive hosts through application control policies

Patch Information

Microsoft has released cumulative security updates addressing CVE-2026-42977. Administrators should consult the Microsoft Security Update Guide for the specific KB articles applicable to each Windows build. Apply the updates through Windows Update, Windows Server Update Services (WSUS), or your enterprise patch management solution.

Workarounds

No official workaround has been published by Microsoft; applying the security update is the only complete mitigation
Where patching is delayed, reduce exposure by enforcing least privilege and limiting local logon to trusted administrators
Consider disabling the Windows Push Notifications User Service (WpnUserService) on servers where it is not required, after testing for application impact

bash

# Verify patch status on a Windows host (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Check Push Notifications service state
Get-Service -Name WpnService, WpnUserService*