CVE-2026-45490: .NET Authorization Bypass Enables Local Privilege Escalation

Technical summary

CVE-2026-45490 involves improper authorization controls in Microsoft .NET, identified through weaknesses in privilege assumption (CWE-266), authorization bypass (CWE-285), and incorrect authorization (CWE-863). The vulnerability requires local access and valid user credentials but no user interaction, enabling a privilege-escalation attack with high impact to confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects the local attack vector, low complexity, and broad post-exploitation reach once privileges are elevated.

Business impact

Successful exploitation could allow insider threats or compromised local accounts to assume administrative control over affected servers and workstations. This directly threatens data confidentiality, system availability, and the integrity of business-critical processes running on affected .NET deployments. Organizations with strict segregation of user roles face degraded access controls, increased risk of lateral movement, and potential regulatory compliance violations if elevated access is used to bypass audit or security controls.

Affected systems

Microsoft .NET deployments on Windows systems are affected. This includes web servers, application servers, and client machines running vulnerable .NET versions. Exposure is highest in environments where multiple users share systems or where service accounts run with elevated privileges, as well as in containerized or virtualized setups where .NET is a core application runtime.

Exploitability

Exploitation requires an attacker to already possess valid local credentials and direct or remote login access to an affected Windows system running .NET. The attack is straightforward (low complexity) and requires no user interaction or special timing. However, the barrier to entry—needing legitimate credentials—means this is primarily a risk for insider threats, compromised accounts, or post-breach lateral movement scenarios rather than unauthenticated remote attacks.

Remediation

Microsoft will provide patched .NET runtime versions addressing the authorization logic flaws. Organizations should prioritize patching all .NET runtimes in their environment, particularly those hosting multi-tenant applications or running services with administrative privileges. Review and enforce strict privilege-separation policies, ensure service accounts operate with minimal necessary permissions, and consider enabling Windows Defender Application Guard or similar isolation controls on high-risk systems.

Patch guidance

Monitor Microsoft Security Updates and the .NET releases page for patched versions. Test patches in non-production environments to confirm compatibility with dependent applications before broad deployment. Prioritize patching in order: production web/application servers, development infrastructure, and then client workstations. Verify patch deployment through version checks and security update history logs.

Detection guidance

Monitor for suspicious privilege-escalation attempts on Windows systems running .NET applications, including unexpected elevation of process privileges, creation of new administrator accounts, or permission changes to sensitive registry keys or files. Audit logs should be reviewed for failed authorization attempts and successful impersonation of higher-privilege accounts. Endpoint detection and response (EDR) tools should flag unauthorized token elevation or process-privilege changes outside normal application behavior.

Why prioritize this

This vulnerability merits immediate attention because it affects core .NET infrastructure used across enterprises, has no mitigating factors limiting its impact, and enables full system compromise through a simple privilege-escalation path. Although it requires pre-existing credentials, the ease of exploitation and breadth of affected systems make it a significant post-breach risk. Prioritize environments where service accounts run with high privileges or where user segregation is weak.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects a local attack vector with low complexity, single user context, and significant impact across all security properties. The score appropriately captures that while an attacker must already have local access and credentials, once successful they gain nearly complete control. Organizations should view this as a high-priority update affecting their attack surface reduction and privilege-management strategies.

Frequently asked questions