CVE-2026-32160: 
vulnerability analysis and mitigation

CVE-2026-32160 is a local privilege escalation vulnerability in the Windows Push Notifications service caused by a race condition (CWE-362). An authorized attacker with low privileges can exploit improper synchronization of shared resources to elevate privileges locally on affected systems. It was disclosed on April 14, 2026, as part of Microsoft's April 2026 Patch Tuesday. Affected products span a wide range of Windows versions including Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), Windows Server 2019, 2022, 2022 23H2, and Windows Server 2025. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC, GitHub Advisory).

The root cause is a race condition (CWE-362) in the Windows Push Notifications service, where concurrent code sequences require temporary exclusive access to a shared resource but a timing window allows another concurrent sequence to modify that resource before access is properly secured. This is consistent with CAPEC-26 (Leveraging Race Conditions) and CAPEC-29 (TOCTOU Race Conditions). Exploitation requires local access with low privileges and has high attack complexity, meaning an attacker must carefully time their actions to win the race window. The changed scope indicator in the CVSS vector suggests the vulnerability can impact resources beyond the initially compromised component, potentially reaching SYSTEM-level privileges (Microsoft MSRC, GitHub Advisory).

Successful exploitation allows a low-privileged local attacker to escalate to SYSTEM-level privileges, resulting in complete system compromise with high confidentiality, integrity, and availability impact. An attacker achieving SYSTEM privileges could execute arbitrary code, access or exfiltrate sensitive data, install persistent backdoors, disable security controls, and use the compromised host as a pivot point for lateral movement within the network. The changed scope in the CVSS rating indicates the impact extends beyond the Windows Push Notifications service itself to the broader operating system (Microsoft MSRC, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.036–0.047%, placing it in the 15th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity requirement — necessitating precise timing to win the race condition — raises the bar for reliable exploitation, though it does not preclude skilled threat actors from weaponizing it (GitHub Advisory).

Microsoft released patches on April 14, 2026, as part of the April 2026 Patch Tuesday. Administrators should apply the following minimum build versions: Windows 10 1809 → 10.0.17763.8644; Windows 10 21H2 → 10.0.19044.7184; Windows 10 22H2 → 10.0.19045.7184; Windows 11 23H2 → 10.0.22631.6936; Windows 11 24H2 → 10.0.26100.8246 (also applies to Server 2025 → 10.0.26100.32690); Windows 11 25H2 → 10.0.26200.8246; Windows 11 26H1 → 10.0.28000.1836; Windows Server 2019 → 10.0.17763.8644; Windows Server 2022 → 10.0.20348.5020; Windows Server 2022 23H2 → 10.0.25398.2274. As a defense-in-depth measure, restrict local interactive and remote desktop access to only authorized users, and monitor for unusual process behavior related to the Windows Push Notifications service (wmpnrcs.exe) (Microsoft MSRC).

The vulnerability was covered as part of broader April 2026 Patch Tuesday roundups by security vendors including Rapid7, Sophos, and NSFOCUS, which highlighted it among the month's privilege escalation vulnerabilities (Rapid7, Sophos, NSFOCUS). No notable individual researcher commentary or significant social media discussion specific to this CVE has been identified beyond standard Patch Tuesday coverage.