CVE-2026-45491: .NET Link-Following Vulnerability – Local File Tampering Risk

Technical summary

CVE-2026-45491 is a link-following vulnerability (CWE-59) in .NET's file access mechanisms. The flaw occurs when the .NET runtime or libraries resolve file paths without adequately following secure practices for symlink verification. An attacker with local system access can craft a symlink pointing to a privileged or protected file, and when a .NET application opens what it believes to be a legitimate file, the improper link resolution causes the actual operation to be performed on the attacker-controlled target. This is a classic time-of-check-to-time-of-use (TOCTOU) style issue in the path resolution layer.

Business impact

Organizations running .NET applications—particularly those hosting user-facing services or multi-tenant systems—face a risk of unauthorized file tampering. An attacker with local access could modify configuration files, application binaries, or data files to escalate privileges, inject malware, or corrupt critical data. For enterprises relying on .NET for internal tools, cloud workloads, or containerized services, this vulnerability could enable lateral movement or persistence within a compromised environment. The impact is narrowed by the local-access requirement, but in scenarios involving shared hosting, containerized environments, or compromised user accounts, the risk becomes material.

Affected systems

The vulnerability affects .NET across multiple operating systems: Microsoft .NET installations on Windows and macOS, as well as systems running .NET on Linux. The .NET runtime, ASP.NET Core, and any application built on .NET that directly or indirectly performs file operations are potentially affected. This includes desktop applications, server-side web services, and cloud-hosted workloads. The scope is not limited to a single product version; organizations should verify patch availability for their specific .NET versions through Microsoft's security advisories.

Exploitability

Exploitation requires local system access and does not require user interaction or elevated privileges at the time of attack, making it moderately straightforward for a local attacker to abuse. However, the vulnerability is not remotely exploitable—an attacker cannot trigger it over the network. Real-world exploitation likelihood depends on the network boundary between untrusted users and the system in question. In shared hosting, multi-tenant cloud, or insider-threat scenarios, the local-access barrier is a minor obstacle. In air-gapped or strictly controlled environments, the risk is lower. There is no evidence of active in-the-wild exploitation at this time.

Remediation

Apply security updates from Microsoft for .NET as they become available. Microsoft will release patches through Windows Update, .NET release channels, and official advisories. Verify the patch availability for your specific .NET version (e.g., .NET 6, 7, 8, or legacy Framework versions) against Microsoft's official security bulletins. Additionally, implement system-level mitigations: restrict local system access through strong access controls, employ file integrity monitoring to detect unauthorized modifications, and follow the principle of least privilege for .NET application service accounts.

Patch guidance

Monitor Microsoft Security Update Guide and .NET release notes for patches addressing CVE-2026-45491. When patches are released, prioritize systems running .NET in multi-user or cloud environments where local-access threats are credible. Test patches in non-production environments before broad deployment to ensure compatibility with your .NET applications. For containerized deployments, ensure base images are updated and container runtimes enforce file-system protections where possible. Verify patch application by confirming runtime version updates and reviewing vendor advisories for any dependency or compatibility notes.

Detection guidance

Implement file integrity monitoring (FIM) on directories containing application files, configuration files, and data stores accessed by .NET applications. Monitor system logs for unusual symlink creation, particularly in temporary directories or directories writable by untrusted users. Use security event logging to detect failed file-access attempts that might indicate exploitation attempts. In containerized environments, monitor for suspicious mount or symlink operations. Correlate suspicious file modifications with process execution logs to identify the source of tampering. Baseline normal .NET application file-access patterns and alert on anomalies.

Why prioritize this

Although the CVSS score of 6.2 places this in the medium severity band, prioritization should account for your environment's exposure. Organizations with strict local-access controls and air-gapped systems may defer this to routine patch cycles. Conversely, cloud-native shops, shared hosting environments, or organizations with significant insider-threat concerns should accelerate patching. The lack of remote exploitability reduces urgency compared to network-facing flaws, but the integrity impact—potential for silent, unauthorized file modification—warrants prompt attention. Not currently listed on the CISA KEV catalog, so no mandate-driven deadline applies, but do not use that as justification for indefinite delay.

Risk score, explained

The CVSS 3.1 score of 6.2 (Medium) reflects a flaw with local-attack surface only (AV:L), no special access required (PR:N), straightforward exploitation (AC:L), no user interaction needed (UI:N), and isolated scope (S:U). The high integrity impact (I:H) reflects the attacker's ability to modify files, but zero confidentiality and availability loss tempers the overall score. This scoring is mathematically sound but may underweight scenarios where unauthorized file modification cascades into system compromise. Organizations should adjust risk perception based on their specific threat model and the criticality of systems exposed to local attackers.

Frequently asked questions