Описание
.NET Elevation of Privilege Vulnerability
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
FAQ
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of this vulnerability requires that a user trigger the payload in the application.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could view sensitive information (Confidentiality) and modify code in the repo, (Integrity), and they might be able to interfere with availability of the code (Availability).
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| .NET 8.0 installed on Windows | ||
| .NET 9.0 installed on Windows | ||
| .NET 10.0 installed on Windows | ||
| Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems | ||
| Microsoft .NET Framework 4.8 on Windows Server 2016 | ||
| Microsoft .NET Framework 4.8 on Windows Server 2012 | ||
| Microsoft .NET Framework 4.8 on Windows Server 2012 R2 | ||
| Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems | ||
| Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for ARM64-based Systems | ||
| Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
EPSS
7.3 High
CVSS3
Связанные уязвимости
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability
Уязвимость программной платформы .NET, связанная с недостаточной проверкой выходных данных, позволяющая нарушителю повысить свои привилегии
EPSS
7.3 High
CVSS3