CVE-2026-70161: .NET Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 7.3)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-13

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the privileges of the user account or service account running the affected process.

Affected Products (5)

Developer Tools

  • .NET 11.0 installed on Windows
  • .NET 9.0 installed on Windows
  • .NET 10.0 installed on Windows
  • Microsoft Visual Studio 2026 version 18.10
  • Microsoft Visual Studio 2022 version 17.14

Security Updates (3)

Acknowledgments

<a href="https://x.com/m4x_1997">Aobo Wang</a>, <a href="https://www.linkedin.com/in/nguyen-hoang-quoc-an-009863267/">kayiz</a> with <a href="http://lp.com.vn/">Lien Phat Technology Corporation</a>, <a href="https://www.linkedin.com/in/đức-nguyễn-văn-minh-19a925287/">Nguyen Van Minh Duc</a> with <a href="https://saigonnewport.com.vn/">Saigon Newport Corporation</a>, <a href="https://www.linkedin.com/in/nguyen-hoang-quoc-an-009863267/">Nguyen Hoang Quoc An</a> with <a href="https://lp.com.vn/">Lien Phat Technology Corporation</a>, <a href="https://x.com/omarkhalil1138">Omar Khaleel</a>

Revision History

  • 2026-10-13: Information published.