AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-44800

Microsoft Windows Push Notifications: race condition

Microsoft

CVE-2026-44800 · Published Jul 14, 2026 · updated Jul 22, 2026

High7.8
Fix: upgrade to 10.0.22631.7376 or later (5 fixed versions below)
Microsoft advisory

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Affected versions

PackageAffectedFixed in
Windows 11 Version 23H2
Product
>= 10.0.22631.0, < 10.0.22631.737610.0.22631.7376
Windows 11 Version 24H2
Product
>= 10.0.26100.0, < 10.0.26100.887510.0.26100.8875
Windows 11 Version 25H2
Product
>= 10.0.26200.0, < 10.0.26200.887510.0.26200.8875
Windows 11 version 23H2
Product
>= 10.0.22631.0, < 10.0.22631.737610.0.22631.7376
Windows 11 version 26H1
Product
>= 10.0.28000.0, < 10.0.28000.252510.0.28000.2525
Windows Server 2025
Product
>= 10.0.26100.0, < 10.0.26100.3315810.0.26100.33158
Windows Server 2025 (Server Core installation)
Product
>= 10.0.26100.0, < 10.0.26100.3315810.0.26100.33158
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-362, CWE-416

More Microsoft advisories

All Microsoft
HighJul 14Secret exfiltration vulnerabilityCVE-2026-47282fixed in 1.128.1HighJul 14Workspace Trust Security Feature Bypass VulnerabilityCVE-2026-57101fixed in 1.128.1HighJul 14Remote Code Execution VulnerabilityCVE-2026-57102fixed in 1.128.1High 7.8Jul 14Microsoft .NET 8.0 runtime: unsafe deserializationCVE-2026-50649fixed in 8.0.29 +9High 7.8Jul 14Microsoft .NET 8.0 runtime: code injectionCVE-2026-50650fixed in 8.0.29 +10High 7.5Jul 14Microsoft .NET 10.0 runtime: resource exhaustionCVE-2026-50651fixed in 10.0.10 +5