Most recent entries from all

bdu:2026-02867

2026-10-06T10:41:53.368698+00:00

bdu:2026-02867

BIT-dotnet-2026-26131 — .NET Elevation of Privilege Vulnerability

2026-10-06T10:41:53.368733+00:00

Affected: Bitnami: dotnet

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.

certfr-2026-avi-0272 — De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer une é…

2026-10-06T10:41:53.368764+00:00

certfr-2026-avi-0272

EUVD-2026-328775

2026-10-06T10:41:53.368782+00:00

EUVD-2026-328775

fkie_cve-2026-26131

2026-10-06T10:41:53.368794+00:00

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.

GHSA-crjq-wm6x-6qx7 — .NET Elevation of Privilege Vulnerability

2026-10-06T10:41:53.368814+00:00

Affected: NuGet: Microsoft.NetCore.App.Runtime.linux-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-arm64, NuGet: Microsoft.NetCore.App.Runtime.linux-musl-x64, NuGet: Microsoft.NetCore.App.Runtime.linux-x64

# Microsoft Security Advisory CVE-2026-26131 – .NET Elevation of Privilege Vulnerability

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

An elevation of privilege vulnerability exists in .NET due to improper authorization. Incorrect packaging permissions could allow an attacker to gain elevated privileges.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/386

## CVSS Details

- **Severity:** High - **Version:** 3.1 - **Score:** 7.8 - **Vector:** `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C` - **Weakness:** CWE-276 (Incorrect Default Permissions)

## Affected Platforms

- **Platforms:** Linux - **Architectures:** All

## Affected Products

### .NET 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- [Microsoft.NetCore.App.Runtime.linux-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-arm64](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64) | >= 10.0.0, <= 10.0.3 | 10.0.4 [Microsoft.NetCore.App.Runtime.linux-musl-arm](https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.l…

msrc_CVE-2026-26131 — .NET Elevation of Privilege Vulnerability

2026-10-06T10:41:53.368883+00:00

msrc_CVE-2026-26131

NCSC-2026-0085 — Kwetsbaarheden verholpen in Microsoft Developer tools

2026-10-06T10:41:53.368900+00:00

NCSC-2026-0085

RHSA-2026:9077 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-10-06T10:41:53.368916+00:00

dotnet: .NET: Privilege escalation via incorrect default permissions dotnet: .NET: Security Bypass and Denial of Service Vulnerability dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw dotnet: .NET: Denial of Service via stack overflow dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform

UBUNTU-CVE-2026-26131

2026-10-06T10:41:53.368937+00:00

Affected: Ubuntu:22.04:LTS: dotnet7

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.

WID-SEC-W-2026-0657 — Microsoft ASP.NET und .NET: Mehrere Schwachstellen

2026-10-06T10:41:53.368955+00:00

Ein lokaler. oder ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft ASP.NET und Microsoft .NET ausnutzen, um Administratorrechte zu erlangen oder um einen Denial-of-Service-Zustand zu verursachen.