CVE-2026-105544: .NET Elevation of Privilege Vulnerability
.NET Elevation of Privilege Vulnerability
Other sources
Improper access control in .NET allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.100 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.321Patch KB5135242 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.404Patch KB5135241 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.45 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.428Patch KB5135243
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Systems running the affected Microsoft .NET, Visual Studio 2026, Visual Studio 2022, or Microsoft.TestPlatform.CLI software may be exposed. Exploitation is local, so the attacker must be able to run or interact with the affected system locally.
What level of access does an attacker need?
The attacker must already be authorized and have low-level privileges on the target system. Exploitation also requires user interaction and has high attack complexity.
What is the potential impact if exploitation succeeds?
A successful exploit can allow elevation of privilege. The listed impact includes high confidentiality, integrity, and availability effects, and the scope can extend beyond the initially affected security authority.