Recorded 20 Oct 2026 at 20:53 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position.
See the latest record.
The historical field “Public exploit code” recorded Nuclei detection-template membership. It did not establish exploit availability. The original recorded fields remain below.
The historical “Publicly disclosed: No” field could represent a missing MSRC assessment. It does not establish that the vulnerability was undisclosed. The original recorded fields remain below.
CVEMicrosoft Security Response Center
.NET Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Issued by
Microsoft
Customer action
Required: apply the update
Affected products
.NET 10.0 installed on Linux, .NET 11.0 installed on Linux, .NET 9.0 installed on Linux, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.9
Updates that fix it
KB5126105: .NET 9.0 installed on Linux; KB5126106: .NET 10.0 installed on Linux
CISA KEV
Not listed in the collected catalog
EPSS
0.8%; scored 20 Oct 2026
Public exploit code
No Nuclei template listed
Published
8 Sep 2026 07:00 UTC
Last revised
25 Sep 2026 07:00 UTC
Revision note
Security Updates table updated provide links to the KB articles and download center updates. Microsoft recommends installing the updates.