.NET CVE-2026-96231

Exploitation requires the attacker to already possess low-privileged authenticated local access to a host running an affected build: .NET 8.0 (<8.0.32), 9.0 (<9.0.21), 10.0 (<10.0.13), 11.0 (<11.0.0-rc.2), Visual Studio 2022 17.14 (<17.14.42), or Visual Studio 2026 18.10 (<18.10.4). The attacker must be able to create or control a symbolic/hard link in a filesystem location that a higher-privileged .NET or Visual Studio process will later resolve and access (CWE-59 link following). Limiting factors: no remote vector (AV:L), prior local authenticated access needed (PR:L), the operation typically depends on timing/race conditions against a privileged process (SSVC Automatable=no), and exploitation is confined to systems where the affected SDK/runtime or IDE is installed - predominantly developer, CI, and build machines rather than general end-user endpoints.

This is a credible but not emergency-grade issue, best treated as routine-high patching priority rather than a drop-everything event. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation requiring the attacker to already have low-privilege authenticated access to the host, with full confidentiality, integrity, and availability impact once exploited. CISA's SSVC framework aligns with a lower urgency: Exploitation=none (no observed activity), Automatable=no (cannot be reliably mass-exploited, consistent with the local-only link-following/race nature of CWE-59), but Technical Impact=total (full compromise of the affected scope). No EPSS score was supplied in the input, and there is no CISA KEV listing and no public POC referenced, so there is no evidence of active exploitation - the signals are consistent rather than conflicting. The one genuine inconsistency is the metadata tag 'Information Disclosure,' which contradicts the description ('elevate privileges locally') and the impact profile of a privilege-escalation flaw; treat the tag as mislabeled, not the vulnerability. Net: a real local EoP worth patching promptly in developer and build environments, but the local-access prerequisite and non-automatable nature keep it well below internet-facing critical risk.

An attacker who already has low-privileged access to a Windows developer or build machine running an affected .NET SDK/runtime or Visual Studio version plants or manipulates a symbolic/hard link so that a higher-privileged .NET or Visual Studio operation follows it to an attacker-controlled target. When the privileged process resolves the link and writes or accesses the file, the attacker redirects that operation to escalate to higher privileges. No public exploit identified at time of analysis, and because exploitation is local and typically involves winning a race window, it is not readily automatable.