CVE-2026-26131

Received Received - Intake

Incorrect Default Permissions in .NET Allow Local Privilege Escalation

Publication date: 2026-03-10

Last updated on: 2026-04-01

Assigner: Microsoft Corporation

Description

Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-10

Last Modified

2026-04-01

Generated

2026-07-06

AI Q&A

2026-03-10

EPSS Evaluated

2026-07-04

NVD

CVE-2026-26131

EUVD

EUVD-2026-10695

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	.net	From 10.0.0 (inc) to 10.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-276	During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

Executive Summary

This vulnerability involves incorrect default permissions in the .NET framework that allow an authorized attacker to elevate their privileges locally.

Impact Analysis

An attacker who already has some level of authorization on the system can exploit this vulnerability to gain higher privileges than intended, potentially leading to full control over the affected system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability involves incorrect default permissions in .NET that allow an authorized attacker to elevate privileges locally.

To mitigate this vulnerability, it is important to apply any security updates or patches provided by Microsoft as soon as they become available.

Hi! I’m here to help you understand CVE-2026-26131. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70