.NET Runtime CVE-2026-96225

Exploitation requires the attacker to already have authenticated, low-privileged local code execution on a host running an affected build: .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), Visual Studio 2022 17.14 (<17.14.42), or Visual Studio 2026 18.10 (<18.10.4). The attacker must be able to create filesystem symbolic links or junctions and win a link-resolution race against a privileged .NET file operation (CWE-59). Limiting factors: the vector is strictly local (AV:L) with no remote/network path, requires existing privileges (PR:L, so not usable by a fully unauthenticated actor), and is not automatable per CISA SSVC; it is a post-compromise escalation primitive rather than an initial-access vulnerability. No user interaction by a victim is needed (UI:N).

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local privilege-escalation flaw: an attacker must already have low-privileged authenticated code execution on the host (PR:L, AV:L), after which a symlink/junction race (CWE-59 link following) yields total compromise of confidentiality, integrity and availability. The signals are internally consistent and point to a post-compromise escalation tool rather than an initial-access threat. CISA's SSVC assessment reinforces lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (local, privilege-gated, not mass-exploitable), though Technical Impact=total matches the C:H/I:H/A:H rating. No EPSS score, CISA KEV listing, or POC indicator is present in the supplied data, so there is no current evidence of active exploitation or published exploit code. Net: treat as a standard-cadence patch priority for Microsoft/.NET/Visual Studio patch cycles - important because the affected runtime is near-universal, but the local-only vector and absence of exploitation signals argue against out-of-band emergency response. Verify exploitation status against live CISA KEV/EPSS feeds, which were not included here.

An attacker who already holds a low-privileged foothold on a Windows host running an affected .NET runtime or Visual Studio (e.g. a standard user or a constrained service account) plants a malicious symbolic link or junction so that a higher-privileged .NET component follows the link and reads, writes, or deletes a file outside its intended path. By winning this link-resolution race, the attacker redirects a privileged file operation to escalate to SYSTEM or administrator. No public exploit identified at time of analysis, and exploitation requires prior local access and low privileges (PR:L).