CVE-2026-35433ImportantRevised 17 Jun

.NET Elevation of Privilege Vulnerability

MSRC advisory NVD CVE.org

Assessment

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

Severity: Important
CVSS base score: 7.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
Impact: Elevation of Privilege
EPSS, next 30 days: 0.6%Higher than 45% of scored CVEs · FIRST model run 29 Sep 2026 · about EPSS
Public exploit code: No Nuclei template lists it
Exploitability: Exploitation Unlikely
Publicly disclosed: No
Customer action: Required: apply the update
Component: .NET
Weakness: CWE-20: Improper Input Validation
Issued by: Microsoft
Published: 12 May 2026 · May 2026
Last revised: 17 Jun 2026This CVE was updated to remove Windows 11 (21H1 and 22H2) as impacted

Updates that fix it

18 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5087048	Security Update	—	Microsoft .NET Framework 3.5 on Windows Server 2012	All CVEs in KB5087048
KB5087049	Security Update	—	Microsoft .NET Framework 3.5 on Windows Server 2012 R2	All CVEs in KB5087049
KB5087051	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 25H2 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 25H2 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025	All CVEs in KB5087051
KB5087053	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for x64-based Systems	All CVEs in KB5087053
KB5087054	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 24H2 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 24H2 for x64-based Systems	All CVEs in KB5087054
KB5087055	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 26H1 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5087055
KB5087058	Security Update	Required	Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 23H2 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 23H2 for x64-based Systems	All CVEs in KB5087058
KB5087059	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022	All CVEs in KB5087059
KB5087061	Security Update	—	Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems	All CVEs in KB5087061
KB5087063	Security Update	—	Microsoft .NET Framework 4.8 on Windows Server 2012 R2	All CVEs in KB5087063
KB5087064	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for x64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for ARM64-based Systems and 1 more	All CVEs in KB5087064
KB5087065	Security Update	—	Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems, Microsoft .NET Framework 4.8 on Windows Server 2016	All CVEs in KB5087065
KB5087066	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for ARM64-based Systems, Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems	All CVEs in KB5087066
KB5087067	Security Update	—	Microsoft .NET Framework 4.8 on Windows Server 2012	All CVEs in KB5087067
KB5087068	Security Update	—	Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022	All CVEs in KB5087068
KB5093446	Security Update	—	.NET 10.0 installed on Windows	All CVEs in KB5093446
KB5093447	Security Update	—	.NET 8.0 installed on Windows	All CVEs in KB5093447
KB5093448	Security Update	—	.NET 9.0 installed on Windows	All CVEs in KB5093448

Affected products

Developer Tools

30 affected products