EUVD-2026-35674
GHSA-77gm-m6x5-jf4f
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft .NET allows an authenticated low-privileged user to elevate to higher privileges through an improper authorization flaw (CWE-285). The vulnerability carries a CVSS 7.8 (High) rating with local attack vector and low complexity, and no public exploit identified at time of analysis. Tagged as an Authentication Bypass, it requires an existing foothold on the host but no user interaction once that foothold is established.
Technical ContextAI
The vulnerability resides in Microsoft .NET, a cross-platform managed runtime and class library used by Windows services, web applications (ASP.NET), and standalone applications. The root cause class is CWE-285 (Improper Authorization), which occurs when the application performs an action but fails to correctly verify that the requesting principal is permitted to perform it. In a runtime/framework context, this typically manifests as a code path where access checks are skipped, performed against the wrong identity, or rely on an attacker-controllable input. Because .NET is used both as a system component on Windows and as an application runtime on Linux/macOS, the affected attack surface includes any local process boundary where .NET enforces an authorization decision.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45490 as soon as it is published for your .NET channel; the provided data indicates an advisory exists but no exact fix version was included, so administrators should consult MSRC for the specific patched build matching their installed runtime (Windows .NET Framework cumulative update, or .NET 6/8/9 runtime and SDK refresh). Until patches can be deployed, reduce exposure by restricting local interactive and remote shell access on affected hosts to trusted administrators, removing or constraining low-privileged service accounts that run .NET-hosted code, and monitoring for unexpected privilege transitions on hosts running .NET workloads - note that these compensating controls reduce but do not eliminate risk and may break automation that legitimately uses those service accounts.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. [CVSS 7.5 HIGH]
Memory corruption in Go's net library (versions <1.25.10 and 1.26.0-1.26.2) leads to application crash when parsing mali
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today