Microsoft .NET: Elevation of privilege through improper access control
Summary
Microsoft .NET 8, 9, 10 and 11 as well as Visual Studio 2022 and 2026 are affected by an improper access control flaw that allows a local, authorized user to elevate privileges. The attacker needs a local account on a system where the affected SDK or Visual Studio is installed, and user interaction is required. Successful exploitation could result in high impact on confidentiality, integrity and availability. Microsoft has published fixed builds, and no exploitation in the wild is known.
Affected
- .NET 8.0.0 to before 8.0.428 (Linux, macOS, Windows)
- .NET 9.0.0 to before 9.0.321 (Linux, macOS, Windows)
- .NET 10.0.0 to before 10.0.404 (Linux, macOS, Windows); per-band fixes apply, see Fixed
- .NET 11.0.0-preview.1 to before 11.0.100 (Linux, macOS, Windows)
- Visual Studio 2022 version 17.14 before 17.14.45
- Visual Studio 2026 version 18.11 before 18.11.4
- Visual Studio 2026 version 18.12.0: fixed build unknown
Fixed in
- SDK 8.0.1xx: 8.0.134
- SDK 8.0.4xx: 8.0.428
- SDK 9.0.1xx: 9.0.124
- SDK 9.0.3xx: 9.0.321
- SDK 10.0.1xx: 10.0.115
- SDK 10.0.4xx: 10.0.404
- Visual Studio 2022 17.14: 17.14.45
- Visual Studio 2026 18.11: 18.11.4
- Visual Studio 2026 18.12: Unknown.
Workaround
- Unknown. No documented workaround found in the sources.
- Install the fixed per-band SDK or Visual Studio build.
- Remove unused .NET SDKs from shared build hosts.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV at the time of research.
- Microsoft exploit code maturity: Unproven (E:U).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
Our recommendation
- Identify hosts with the .NET SDK or Visual Studio installed, especially developer workstations, build and CI servers, and shared hosts.
- Update to the per-band fixed builds listed above; do not rely on the simple range 'before 10.0.404', because 10.0.100 to 10.0.114 are fixed in 10.0.115.
- Verify Visual Studio 2026 18.12 builds with Microsoft, as no fixed version is known.
- Remove unused SDKs and limit local accounts on shared hosts.
- Schedule the patch with the November 2026 updates; priority medium-high for development and build systems, medium or low elsewhere.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-105544 msrc.microsoft.com
- CVE Record CVE-2026-105544 www.cve.org
- dotnet/announcements advisory (Nov 10, 2026) github.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Senserva KB 5135243 senserva.com
- third-party analysis cvereports GHSA-6856-87HX-P5X7 cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:12.
Original description (NVD)
Improper access control in .NET allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.