CVE-2026-70190: .NET Elevation of Privilege Vulnerability
.NET Elevation of Privilege Vulnerability
Other sources
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.113Patch KB5130036 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.319, 9.0.122 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.100-rc.2
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Systems running one of the listed affected products are in scope: Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, or Microsoft .NET 9.0, 10.0, or 11.0 installed on Windows.
What does an attacker need to exploit it?
The attacker must already be authorized to access the affected system and must be able to act locally. Exploitation also requires user interaction.
What is the potential impact of successful exploitation?
A successful attacker could elevate privileges locally. The supplied severity vector indicates high impact to confidentiality, integrity, and availability.