What is the CVSS score of CVE-2026-26131?

CVE-2026-26131 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Red Hat are affected by CVE-2026-26131?

CVE-2026-26131 affects .NET environments and allows authorized users to escalate their privileges to higher system levels.. A patch is available.

How to fix or mitigate CVE-2026-26131?

Within 24 hours: Inventory all .NET deployments and identify systems running affected versions; restrict administrative access and review privileged account activities for suspicious behavior. Within 7 days: Implement enhanced monitoring of privilege escalation attempts and enforce principle of least privilege across .NET applications and services. Within 30 days: Establish a patch readiness plan with the vendor; prepare and test patches in non-production environments immediately upon release and deploy to production systems within 48 hours of validation.

Red Hat CVE-2026-26131

HIGH

Incorrect Default Permissions (CWE-276)

2026-03-10 secure@microsoft.com

GHSA-crjq-wm6x-6qx7

Privilege Escalation Red Hat

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.8 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.8

DescriptionCVE.org

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.

AnalysisAI

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally. [CVSS 7.8 HIGH]

Technical ContextAI

Classified as CWE-276 (Incorrect Default Permissions). Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.