What is the CVSS score of CVE-2026-62872?

CVE-2026-62872 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of .NET Framework are affected by CVE-2026-62872?

Microsoft .NET Framework versions 3.5 through 4.8.1 contain a privilege escalation vulnerability affecting Windows enterprise deployments globally.. A patch is available.

How to fix or mitigate CVE-2026-62872?

Within 24 hours: Identify all systems running .NET Framework versions 3.5-4.8.1, prioritizing internet-facing servers and systems storing sensitive data. Within 7 days: Deploy the Microsoft-released patch to non-production environments first to validate compatibility with dependent applications. Within 30 days: Complete patch deployment to all production systems and verify installation success across the organization.

.NET Framework CVE-2026-62872

EUVD-2026-56680 HIGH

Incorrect Authorization (CWE-863)

2026-08-11 secure@microsoft.com

GHSA-43g4-v893-w7hq

Authentication Bypass Microsoft Red Hat Net Framework

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network vector and PR:L confirmed by 'authorized attacker over a network'; full CIA from privilege escalation; S:U as description indicates no scope change beyond the vulnerable component.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:08 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft .NET Framework via incorrect authorization (CWE-863) allows network-authenticated low-privilege attackers to elevate their privileges, achieving full compromise of confidentiality, integrity, and availability on affected systems. Affected release families span .NET Framework 3.5 through 4.8.1, covering a broad swath of Windows enterprise deployments across multiple independently-installed runtime versions. No public exploit has been identified at time of analysis; a vendor-released patch with specific fix version thresholds is available through the Microsoft Security Response Center.

Technical ContextAI

CWE-863 (Incorrect Authorization) describes a failure to correctly verify whether an authenticated principal holds the required permissions for a requested operation, distinct from authentication failure - the attacker presents valid credentials but the framework incorrectly grants access beyond their authorized scope. In Microsoft .NET Framework, this flaw exists in the runtime's authorization layer and is reachable over the network. The affected product spans multiple coexisting runtime families - .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1 - which can all be present simultaneously on a single Windows host, meaning multiple independent runtime installations may each require patching independently. The 'Authentication Bypass' tag from the intelligence data reinforces that the flaw enables circumvention of authorization controls despite valid credential presentation, rather than unauthenticated bypass.

RemediationAI

Apply Microsoft's released security update via Windows Update or manually through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62872. Confirmed fix version thresholds per ENISA EUVD data are: .NET Framework 4.8 to 4.8.4805.0 or later, .NET Framework 4.8.1 to 4.8.9344.0 or later, .NET Framework 4.6.2/4.7/4.7.1/4.7.2 to 4.7.4144.0 or later, and .NET Framework 3.5 to component builds 2.0.50727.9183 and 3.0.30729.9169 or later. Organizations must patch each coexisting runtime installation independently, as a patched 4.8 runtime does not protect a separately installed 3.5 runtime on the same host. As a compensating control prior to patching, restrict network access to .NET-dependent service endpoints to the minimum necessary set of authenticated principals using host-based firewalls or network ACLs; note this does not eliminate the underlying authorization flaw and introduces operational risk if service consumers are inadvertently blocked.