CVE-2026-70161: .NET Elevation of Privilege Vulnerability
.NET Elevation of Privilege Vulnerability
Other sources
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.100-rc.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.319, 9.0.122 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.402Patch KB5130036 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4
Event History
Frequently Asked Questions
Which systems are in scope for this issue?
The affected software listed is Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, and Microsoft .NET 9.0, 10.0, and 11.0 when installed on Windows.
What access does an attacker need to exploit this vulnerability?
Exploitation requires local access, existing low-level privileges, and user interaction. The available information describes an authorized local attacker rather than an unauthenticated remote attacker.