A link following flaw (CWE-59) in the Windows elevated workload installer of the .NET SDK allows a local user with low privileges to escalate their privileges. The installer can be tricked into following a junction or symbolic link under %ProgramData%\dotnet. Exploitation requires a local account and user interaction, such as a user acting on a crafted file or link. Microsoft patched the issue on 13 October 2026; no public PoC or exploitation is known.
Microsoft · .NET SDK
A security feature bypass in the Kestrel web server built into ASP.NET Core allows an unauthenticated remote attacker to bypass a security control over the network. Microsoft describes the flaw as Kestrel accepting line-break characters in HTTP/2 trailers and HPACK dynamic table values instead of rejecting them as malformed, which is classified as HTTP request smuggling (CWE-444). No privileges or user interaction are required, and the CVSS 3.1 base score is 9.1 (Critical). According to the official record, confidentiality and integrity impact is high and availability impact is none.
Microsoft · ASP.NET Core
A use-after-free flaw in the Remote Desktop Gateway Service of Windows Remote Desktop Services allows an unauthenticated attacker to execute code remotely over the network. The attack complexity is high, and no privileges or user interaction are required. The main exposure is a Gateway reachable from untrusted networks, such as the internet.
Microsoft · Windows Remote Desktop Services
A deadlock in Kestrel, the web server built into ASP.NET Core, can be triggered by an unauthenticated remote attacker. The attacker sends crafted HTTP/3 reset or abort sequences, which block connection handling and create many blocked threads. Repeated requests can exhaust server resources and make the application unresponsive. Only availability is affected, and internet-facing applications with HTTP/3 enabled are the highest priority.
Microsoft · ASP.NET Core
A protection mechanism failure in Windows PowerShell allows an authorized local user to bypass a security feature. The CVSS score of 8.8 reflects a scope change and high impact on confidentiality, integrity and availability. The attacker needs a valid local low-privilege account, so the flaw is mainly a follow-on step after another compromise, such as phishing or a stolen password.
Microsoft · Windows PowerShell
A flaw in the Windows Backup Engine (CWE-41, improper resolution of path equivalence) allows a locally authorized user to elevate privileges. CVSS v3.1 base score is 7.8 (High). Exploitation requires local access with low privileges and no user interaction; a successful attack gives the attacker high impact on confidentiality, integrity and availability.
Microsoft · Windows Backup Engine
ASP.NET Core contains a race condition (CWE-362) in its authorization components, including Blazor AuthorizeRouteView, that allows an authorized attacker to elevate privileges over the network. A stale asynchronous authorization result can be applied after navigation or an authorization state change, bypassing the current [Authorize] decision. Exploitation requires a valid user account, high attack complexity and precise timing. NVD assigns a CVSS 3.1 base score of 7.5 (High).
Microsoft · ASP.NET Core
A flaw in ASP.NET Core allows unauthenticated remote attackers to exhaust server resources and cause a denial of service. According to research notes, FileBufferingReadStream eagerly rents buffers during multipart processing, so crafted multipart requests can exhaust memory. No confidentiality or integrity impact is reported, and no user interaction is required.
Microsoft · ASP.NET Core
The Negotiate authentication handler (Microsoft.AspNetCore.Authentication.Negotiate) in ASP.NET Core can attach role claims from the wrong directory account to an authenticated user. This happens when LDAP claim resolution is enabled and the LDAP result is not verified against the Kerberos principal SID. An attacker with a valid low-privilege account on the target can thereby gain the roles of another account; the CVSS score is 7.5 (High), but the attack complexity is high.
Microsoft · ASP.NET Core
A numeric truncation error (CWE-197, CWE-20) in the Windows Search Component allows an authorized local user to elevate privileges. The attacker needs valid low-privileged access to the system and no user interaction is required. According to the CVSS 3.1 record, a successful attack would give full control over confidentiality, integrity and availability (7.8, High).
Microsoft · Windows Search Component
A use-after-free flaw in the Win32k kernel subsystem of Windows allows a local attacker with low privileges to elevate their rights, potentially to SYSTEM. The attacker must already have access to the system, for example through a compromised user account or service. Once exploited, the flaw can lead to full control of the affected machine, since it runs in kernel mode.
Microsoft · Windows
Improper authentication in ASP.NET Core allows an unauthorized remote attacker to elevate privileges. Identity password-reset and confirmation mails can be sent to an unvalidated request address instead of the address stored on the user account, which can lead to account takeover. The risk is mainly for internet-facing apps that use the default Identity UI pages with working email sending; attack complexity is high and no privileges are required.
Microsoft · ASP.NET Core
Microsoft .NET contains a remote code execution flaw in the WPF runtime (Microsoft.WindowsDesktop.App.Runtime), which is Windows-only. Per Microsoft, WPF XPS hyperlink navigation can bypass URI restrictions and reach an attacker-controlled ObjectDataProvider. An attacker needs a user to open a crafted XPS document in a WPF application and follow a link, which can lead to code execution with the user's rights. The NVD description (network, no user interaction) differs from Microsoft's framing, so the Microsoft description is used here.
Microsoft · .NET
Research and translation in progress – available shortly.
An untrusted pointer dereference in the Windows NTFS file system driver allows a local attacker with a valid low-privilege account to elevate privileges, potentially to SYSTEM. The CVSS vector requires local access, low privileges and no user interaction, so the flaw is not directly reachable from the internet. The main risk is an attacker who already has a foothold, for example through phishing or a stolen user login, on shared PCs, terminal servers or file servers.
Microsoft · Windows NTFS
Research and translation in progress – available shortly.
A race condition in the Windows Connected Devices Platform Service allows an authorized local user to elevate privileges to SYSTEM. The attacker needs a low-privileged account or code already running on the affected machine. Attack complexity is high, and Microsoft marks the vulnerability as not exploited with unproven exploit code.
Microsoft · Windows Connected Devices Platform Service
The Windows Ancillary Function Driver for WinSock in Windows 10 Version 1607 and Windows Server 2016 contains a use-after-free flaw (CWE-416). A local attacker with low privileges who wins a race condition can gain SYSTEM privileges, with high impact on confidentiality, integrity and availability. The vulnerability is not remotely exploitable and requires local code execution or a low-privilege account on the system. Microsoft reports no public disclosure and no known exploitation.
Microsoft · Windows 10 1607
A type confusion weakness in the Windows DNS Server role allows an authorized attacker to execute code remotely over the network. Microsoft lists the impact as Remote Code Execution with an Important severity and a CVSS base score of 8.8. The sources do not describe the exact access level required beyond authorization, so an attacker with any valid foothold in the network should be considered possible.
Microsoft · Windows Server 2022
Research and translation in progress – available shortly.
A link-following weakness (CWE-59) in Microsoft .NET allows an authorized local attacker to elevate privileges. The advisory describes it as an issue in .NET SDK workload installation and advertising manifests. The attacker needs a local low-privilege account and a user interaction (UI:R), and the CVSS score is 6.7 (medium).
Microsoft · .NET
A use-after-free flaw (CWE-416) in the Windows TCP/IP network stack affects several supported and older Windows 10, Windows 11 and Windows Server versions. An attacker who already has local access with low privileges, for example a logged-in user or a malicious process, can elevate privileges to full control of the host. The flaw is not directly reachable from the internet, and CISA SSVC lists exploitation as none.
Microsoft · Windows 10 1607
Microsoft's OpenSSH for Windows allocates resources without limits or throttling (CWE-770). A remote, unauthenticated attacker can exhaust these resources and disrupt the SSH service. Only availability is affected, and exposure depends on whether the Windows OpenSSH server is enabled and reachable over the network.
Microsoft · OpenSSH for Windows
A path traversal flaw in the .NET SDK's workload support lets an authorized local user escalate privileges. An attacker-controlled workload manifest ID can escape the intended folder under %ProgramData%\dotnet and get attacker-controlled MSBuild targets imported during elevated operations. Exploitation requires a local foothold, a manipulated manifest and an elevated 'dotnet workload' run, and the flaw is not network-reachable.
Microsoft · .NET SDK
A use-after-free flaw (CWE-416) in the Windows kernel of Windows 10 Version 1607 allows an attacker with a local, low-privileged account to elevate privileges. The attack is rated as high complexity and requires no user interaction, and successful exploitation has high impact on confidentiality, integrity and availability. The flaw is not directly exploitable from the internet, so the risk is mainly on shared or legacy systems where an attacker already has local access. Windows 10 Enterprise LTSB 2016 reached the end of updates on 13 October 2026.
Microsoft · Windows 10 1607
