Privilege Escalation Vulnerability in .NET by Microsoft
CVE-2026-70165

6.7MEDIUM

Key Information:

Vendor

Microsoft
Status
.net 10.0 Runtime
.net 11.0 Runtime
.net 9.0 Runtime
Microsoft Visual Studio 2022 Version 17.14
Vendor
CVE Published:
13 October 2026

What is CVE-2026-70165?

The vulnerability in .NET arises from improper link resolution before file access, known as 'link following.' This allows an authorized attacker to gain elevated privileges on the local system, potentially leading to unauthorized access and control over sensitive files and operations. Users are encouraged to review their .NET versions and apply the necessary patches to mitigate this risk.

Affected Version(s)

.NET 10.0 runtime 10.0.0 < 10.0.402

.NET 11.0 runtime 11.0.0 < 11.0.100-rc.2

.NET 9.0 runtime 9.0.0 < 9.0.319, 9.0.122

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.