CVE-2026-45490

highpriority · track · 0OT risk · elevatedEPSS 0.004 · 36 %ileDEEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.42% (36th) EPSS

CVSS 7.8 · high

Is it mine?

57 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-23

Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixed.NET 10.0 installed on Windowsmsrc_csaf
10.0.9:Security Update:https://support.microsoft.com/help/5097148
https://support.microsoft.com/help/5097148
Fixed.NET 8.0 installed on Windowsmsrc_csaf
8.0.28:Security Update:https://support.microsoft.com/help/5097149
https://support.microsoft.com/help/5097149
Fixed.NET 9.0 installed on Windowsmsrc_csaf
9.0.17:Security Update:https://support.microsoft.com/help/5097150
https://support.microsoft.com/help/5097150

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · secure@microsoft.com USexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-266USCWE-285USCWE-285USCWE-285USCWE-863US

affected products (57)

Products and version ranges known to be affected.

Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Microsoft .NET 10.0all versionscert_bundDEcpe:/a:microsoft:.net:10.0
Microsoft .NET 8.0all versionscert_bundDEcpe:/a:microsoft:.net:8.0
Microsoft .NET 9.0all versionscert_bundDEcpe:/a:microsoft:.net:9.0
Microsoft ASP.NET Core 10.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_10.0
Microsoft ASP.NET Core 8.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_8.0
Microsoft ASP.NET Core 9.0all versionscert_bundDEcpe:/a:microsoft:asp.net:core_9.0
Microsoft Visual Studio 2026 version 18.6all versionscert_bundDE
Microsoft Visual Studio Codeall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-
Microsoft Visual Studio Code - MSSQL Extensionall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-_mssql_extension
Microsoft Visual Studio Code CoPilot Chat Extensionall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:copilot_chat_extension
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Microsoft Visual Studio 2026≤ version 18.6cert_bundDE
Microsoft .NET 10.010.0.0 → 10.0.9enisa_euvdEU
Microsoft .NET 8.08.0.0 → 8.0.28enisa_euvdEU
Microsoft .NET 9.09.0.0 → 9.0.17enisa_euvdEU
Microsoft Corp .NET10.0 → 10.0.9fstec_bduRU

showing 20 of 57

advisories (5)

Vendor and ecosystem advisories describing this.

NCSC-2026-0184Kwetsbaarheden verholpen in Microsoft Developer ToolsNL2026-06-09csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Developer Tools.
WID-SEC-W-2026-1845Microsoft DeveloperTools: Mehrere SchwachstellenDeutsch2026-06-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, Microsoft ASP.NET, Microsoft .NET und Microsoft Visual Studio 2026 ausnutzen, um Administratorrechte zu erlangen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder die Authentifizierung zu umgehen.
msrc_CVE-2026-45490.NET SDK Elevation of Privilege Vulnerability2026-06-09csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
BIT-dotnet-2026-45490.NET SDK Elevation of Privilege Vulnerability2026-06-18vendor · osvUS
Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
BIT-dotnet-sdk-2026-45490.NET SDK Elevation of Privilege Vulnerability2026-06-18vendor · osvUS
Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl msrc_csaf NVD CVE.org MITRE

published 2026-06-09modified 2026-07-28

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan