CVE-2026-44800: Windows 11 23h2 Privilege Escalation Flaw

CVE-2026-44800 Overview

CVE-2026-44800 is a race condition vulnerability in the Windows Push Notifications component. The flaw stems from concurrent execution using a shared resource with improper synchronization [CWE-362]. An authorized local attacker can exploit the timing window to elevate privileges on affected systems. Microsoft published the advisory on July 14, 2026, covering multiple supported Windows client and server versions.

The vulnerability requires local access and low privileges but does not require user interaction. Successful exploitation results in a scope change with high impact to confidentiality, integrity, and availability. No public proof-of-concept exploit is available at the time of publication, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A local, authenticated attacker who wins the race condition can escalate to higher privileges and compromise the confidentiality, integrity, and availability of the host.

Affected Products

Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64)
Microsoft Windows Server 2025 (x64)
Systems running the Windows Push Notification Service (WNS) client components

Discovery Timeline

2026-07-14 - CVE-2026-44800 published to the National Vulnerability Database
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-44800

Vulnerability Analysis

The Windows Push Notifications subsystem delivers toast, tile, and raw notifications to applications through the Windows Push Notification Service (WNS) and related user-mode and kernel-mode components. This subsystem processes concurrent requests from multiple callers and manages shared state on behalf of those callers.

CVE-2026-44800 arises when two or more threads access a shared resource without proper synchronization. An attacker who can trigger notification operations from a low-privileged context can race the service and manipulate resource state during the unsynchronized window. Winning the race allows the attacker to execute code or perform actions in the security context of a more privileged process. Attack complexity is rated high because the attacker must reliably hit the timing window, but successful exploitation crosses a security scope boundary.

Root Cause

The root cause is a classic Time-of-Check to Time-of-Use (TOCTOU) class defect within the Push Notifications code path. A resource is validated or referenced in one operation, then acted upon in a subsequent operation without holding a lock, reference count, or equivalent synchronization primitive across both steps. A parallel thread can substitute or free the resource between those steps.

Attack Vector

Exploitation is local. The attacker must already possess valid credentials on the target host and the ability to run code as a standard user. From that context, the attacker repeatedly invokes Push Notification APIs while a second thread races to modify the shared resource. The vulnerability mechanism is described in prose only; no verified public exploit code is available. Consult the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-44800

Indicators of Compromise

Unexpected child processes spawned by WpnUserService, WpnService, or related notification host processes running with elevated tokens
Repeated, high-frequency calls into notification-related APIs from a single standard-user process, consistent with race-window brute forcing
New services, scheduled tasks, or persistence artifacts created immediately after anomalous notification service activity

Detection Strategies

Hunt for standard-user processes that suddenly obtain SYSTEM or high-integrity tokens without a documented UAC elevation event
Correlate crashes or access violations in WpnUserService.dll or related modules with subsequent privileged process creation
Baseline normal per-user call rates to notification APIs and alert on statistical outliers indicative of race-condition attempts

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging and forward events to a centralized analytics platform
Monitor Application and System event logs for repeated Push Notification service errors, restarts, or exception traces
Track token elevation events (Event IDs 4672, 4673) associated with processes that were originally launched by non-administrative users

How to Mitigate CVE-2026-44800

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows 11 and Windows Server 2025 systems
Prioritize patching for multi-user hosts, jump servers, and Remote Desktop Session Hosts where local privilege escalation has the greatest blast radius
Restrict interactive and remote logon rights on servers to the minimum set of administrative accounts

Patch Information

Microsoft has issued security updates for Windows 11 23H2, 24H2, 25H2, 26H1, and Windows Server 2025 on both x64 and ARM64 architectures where applicable. Deploy the cumulative update via Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or Configuration Manager. Verify installation by confirming the updated build number reported by winver matches the version listed in the Microsoft advisory.

Workarounds

No official vendor workaround is published; applying the security update is the supported remediation
Reduce exposure by enforcing least-privilege access and preventing untrusted code execution on affected hosts through application control policies such as Windows Defender Application Control (WDAC) or AppLocker
Segment and monitor administrative accounts so that a successful local elevation does not immediately translate into lateral movement

bash

# Verify installed Windows build after patch deployment
winver

# PowerShell: list installed security updates and confirm the relevant KB is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20

# PowerShell: check the Windows Push Notification User Service status
Get-Service -Name WpnUserService* | Format-Table -AutoSize