Microsoft .NET SDK: Local privilege escalation via link following
Summary
A link following flaw (CWE-59) in the Windows elevated workload installer of the .NET SDK allows a local user with low privileges to escalate their privileges. The installer can be tricked into following a junction or symbolic link under %ProgramData%\dotnet. Exploitation requires a local account and user interaction, such as a user acting on a crafted file or link. Microsoft patched the issue on 13 October 2026; no public PoC or exploitation is known.
Affected
- .NET SDK 11.0 previews: 11.0.100-preview.1 to 11.0.100-rc.1
- .NET SDK 10.0.400 band: 10.0.400 to 10.0.401
- .NET SDK 10.0.100 band: 10.0.100 to 10.0.112
- The CNA record also lists .NET 9.0, 10.0 and 11.0 runtime ranges and Visual Studio 2022 and 2026 ranges. The advisory mirror does not confirm these; verify on the MSRC page.
- .NET 6 (EOL): not assessed by Microsoft. A third-party source reports 6.0.100 to 6.0.437 (unverified).
Fixed in
- .NET SDK 11.0.100-rc.2
- .NET SDK 10.0.402
- .NET SDK 10.0.113
- Visual Studio: fixed builds per the MSRC advisory (unverified).
Workaround
Unknown. No vendor workaround found; apply the fixed SDK version.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV as far as determined (not confirmed on cisa.gov).
- No public PoC found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Inventory Windows hosts with the .NET SDK, including Visual Studio installs, and record their versions.
- Update to the fixed versions listed above, prioritising developer workstations and build hosts.
- Plan an upgrade for .NET 6 or other EOL SDKs.
- Confirm the final affected list on the MSRC page before closing the ticket.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center: CVE-2026-70190 msrc.microsoft.com
- dotnet/sdk issue 56612 (mirror of Microsoft advisory) github.com
- HeroDevs vulnerability directory: CVE-2026-70190 www.herodevs.com
- Vulners NVD record: CVE-2026-70190 vulners.com
- Vulners Microsoft CVE record: MS:CVE-2026-70190 vulners.com
- Ubuntu security tracker: CVE-2026-70190 ubuntu.com
- Rapid7: October 2026 Patch Tuesday www.rapid7.com
- Strix: CVE-2026-70190 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 02:09.
Original description (NVD)
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.