CVE-2026-70190: .NET Elevation of Privilege Vulnerability

Overview

Severity

High (CVSS 7.3)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

FAQ

What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could create, modify, or delete files in the security context of the "NT AUTHORITY\SYSTEM" account.

Affected Products (5)

Developer Tools

• .NET 9.0 installed on Windows
• .NET 10.0 installed on Windows
• Microsoft Visual Studio 2026 version 18.10
• Microsoft Visual Studio 2022 version 17.14
• .NET 11.0 installed on Windows

Security Updates (3)

• Release Notes
• 5130036
• Release Notes

Acknowledgments

Coşkun Bağrıaçık

Revision History

• 2026-10-13: Information published.