Microsoft .NET: Link following enables local privilege escalation
Summary
A link-following weakness (CWE-59) in Microsoft .NET allows an authorized local attacker to elevate privileges. The advisory describes it as an issue in .NET SDK workload installation and advertising manifests. The attacker needs a local low-privilege account and a user interaction (UI:R), and the CVSS score is 6.7 (medium).
Affected
- .NET SDK 11.0.100-preview.1 to 11.0.100-rc.1 (per Microsoft GitHub advisory)
- .NET SDK 10.0.100 to 10.0.112 (per Microsoft GitHub advisory)
- .NET SDK 10.0.400 to 10.0.401 (per Microsoft GitHub advisory)
- Microsoft .NET 9.0, 10.0 and 11.0 runtimes, Visual Studio 2022 17.14 and Visual Studio 2026 18.10 are listed as affected in the CVE record; exact runtime and Visual Studio thresholds are unconfirmed.
Fixed in
- .NET SDK 11.0.100-rc.2 (for 11.0 line)
- .NET SDK 10.0.113 (for 10.0.100 to 10.0.112)
- .NET SDK 10.0.402 (for 10.0.400 to 10.0.401)
- Runtime and Visual Studio fixed versions from secondary sources (unconfirmed): .NET 9.0.319 and 9.0.122, .NET 10.0.402, .NET 11.0.100-rc.2, Visual Studio 2022 17.14.42, Visual Studio 2026 18.10.4
Workaround
Unknown. No vendor-documented workaround. Apply the patch.
Exploitation
- Microsoft exploitability rating: Unknown (not confirmed in the reviewed sources)
- Rapid7: Exploitation Less Likely, not publicly disclosed
- CISA SSVC: Exploitation none, not automatable
- CISA KEV: not listed
- Public proof of concept: none found; treat as unknown
Our recommendation
- Update the .NET SDK, runtimes and Visual Studio to the fixed versions, including on developer workstations, build servers and CI runners.
- Use the Visual Studio update prompt or the latest .NET installer to update SDKs installed through Visual Studio.
- Check installed .NET SDK versions (dotnet --list-sdks) and Visual Studio versions on developer and build machines.
- Restrict local accounts on shared build hosts and monitor for unexpected privilege changes.
- Patch priority: medium, within the October 2026 patch cycle.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-70165 msrc.microsoft.com
- Microsoft .NET GitHub advisory (dotnet/announcements #455) github.com
- Rapid7 Patch Tuesday October 2026 www.rapid7.com
- OSV: Ubuntu CVE-2026-70165 osv.dev
- Vulners CVELIST: CVE-2026-70165 vulners.com
- OpenCVE: CVE-2026-70165 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 5 Nov 2026, 00:53.
Original description (NVD)
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.