.NET Framework CVE-2026-65810

Exploitation requires local access to a Windows system running a vulnerable version of .NET Framework - remote unauthenticated exploitation is excluded by the AV:L vector. No prior privileges are required (PR:N), meaning a standard unprivileged local user account is sufficient. User interaction is required (UI:R), meaning the targeted user or the attacker themselves must perform some action to trigger the vulnerable code path, such as running a crafted application or opening a malicious file within a .NET context. Exploitation is limited to users with local logon rights to an affected system; remote-only accounts or systems with no interactive user sessions are not exposed through this vector. The specific triggering action and the exact .NET Framework feature or API involved in the path traversal were not detailed in the available description.

The CVSS 7.8 High score is well-supported by the C:H/I:H/A:H impact triad and local attack vector. The PR:N (no privileges required) combined with AV:L is an important signal: this is not an authenticated admin-level flaw but rather one exploitable by any local, unprivileged user, which expands the realistic attacker population significantly - even a standard domain user on a shared workstation could be the threat actor. The UI:R component moderates urgency slightly, as exploitation is not fully autonomous and requires some user action. EPSS data was not provided, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in CISA KEV, and no POC has been identified, indicating no confirmed active exploitation at time of analysis. The CVSS vector accurately reflects the described scenario, with no apparent contradictions between the vector and the description. The primary risk is insider threat or post-initial-access lateral movement: an attacker who has already obtained any local foothold on a Windows system running .NET Framework could use this to escalate to SYSTEM or administrator. Organizations with large Windows estates and mixed-trust user environments - shared developer workstations, terminal servers, or VDI environments - face the highest realistic exposure.

A standard domain user with local logon access to a Windows workstation running a vulnerable version of .NET Framework performs an action - such as opening a crafted document, running a specially constructed application, or interacting with a vulnerable installer - that triggers a path traversal in a .NET Framework component. The traversal allows the attacker's input to reference a privileged system path, causing a higher-privileged process to act on attacker-controlled data and resulting in code execution or file writes at an elevated privilege level. No public proof-of-concept exploit has been identified, but the low attack complexity (AC:L) suggests that once the traversal primitive is understood, reliable exploitation would not require advanced techniques.