.NET Framework CVE-2026-62872

Exploitation requires the attacker to hold at minimum a low-privilege authenticated account (PR:L per CVSS vector) with network access to a service endpoint running on an unpatched .NET Framework installation. No user interaction is required and attack complexity is low, meaning no secondary preconditions, race conditions, or environmental quirks are needed beyond the authenticated network session. The specific .NET API, subsystem, or service type that triggers the authorization bypass is not disclosed in available data, limiting defenders' ability to surgically restrict the vulnerable code path. Systems running the patched component builds (4.8.4805.0, 4.8.9344.0, 4.7.4144.0, or the corresponding 3.5 component versions) are not affected. Purely local deployments with no network-accessible .NET service endpoints have materially reduced exposure.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity, straightforward network exploitation path requiring only low-privilege credentials with no user interaction and full CIA impact upon success. EPSS data is not provided in available intelligence, precluding quantitative exploitation probability assessment - this is a gap in confidence. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified at time of analysis, which modestly lowers immediate urgency compared to confirmed-exploited flaws. That said, given .NET Framework's deep deployment across enterprise Windows environments, even a mid-sized municipal IT team in kielce managing standard Windows infrastructure would face meaningful exposure, since any domain user or service account could plausibly serve as the attacker's initial foothold. The low attack complexity, broad affected version range, and full CIA triad impact make rapid application of the available vendor patch the appropriate organizational response.

A low-privileged authenticated user - such as a standard domain account or application service account - sends a crafted network request to a .NET Framework-based service on an unpatched Windows host, triggering the incorrect authorization check to bypass role or permission enforcement. The AC:L rating indicates no race conditions or special timing are required, making the technique repeatable and mechanically straightforward once the authorization bypass path is identified. No public exploit code has been identified at time of analysis, but the low complexity and high CIA impact make this a candidate for rapid weaponization once exploitation techniques are publicly documented.