CVE-2026-45490: .NET Privilege Escalation Vulnerability

CVE-2026-45490 Overview

CVE-2026-45490 is an improper authorization vulnerability in Microsoft .NET that allows an authorized local attacker to elevate privileges. The flaw is categorized under [CWE-285] Improper Authorization. An attacker with valid low-privileged access to an affected system can exploit the weakness to gain higher privileges on the local host. Microsoft published the advisory on June 9, 2026. The vulnerability impacts confidentiality, integrity, and availability on the affected endpoint.

Critical Impact
A local authorized user can escalate privileges on systems running affected .NET versions, gaining elevated access to protected resources and operations.

Affected Products

Microsoft .NET (see vendor advisory for affected versions)
Applications and services running on impacted .NET runtimes
Windows endpoints with vulnerable .NET components installed

Discovery Timeline

2026-06-09 - CVE-2026-45490 published to the National Vulnerability Database (NVD)
2026-06-09 - Microsoft Security Response Center publishes advisory
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45490

Vulnerability Analysis

The vulnerability is an improper authorization weakness within Microsoft .NET. The runtime fails to correctly enforce authorization checks on a privileged operation. An attacker who already holds a low-privileged account on the target system can invoke functionality that should be restricted to higher-privileged users.

Exploitation requires local access and low-level privileges. No user interaction is needed once the attacker has a foothold. Successful exploitation yields high impact on confidentiality, integrity, and availability of the affected host. The attack vector is constrained to the local system, which limits remote mass-exploitation but raises post-compromise risk in multi-user and server environments.

Root Cause

The root cause is [CWE-285] Improper Authorization. The affected .NET component performs an action without verifying that the calling principal has the required permissions. Authorization logic is missing, incomplete, or incorrectly evaluated for the privileged code path. The Microsoft advisory provides specific component and version detail.

Attack Vector

An authorized local user invokes the vulnerable .NET code path with crafted input or call sequence. The runtime executes the privileged operation without rejecting the unauthorized request. The attacker then performs actions reserved for higher-privileged users, including reading protected data, modifying system state, or disrupting services.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update CVE-2026-45490 advisory for technical detail.

Detection Methods for CVE-2026-45490

Indicators of Compromise

Unexpected privilege transitions originating from .NET host processes such as dotnet.exe or applications using the affected runtime
Local user accounts performing actions that exceed their assigned role or group membership
Event Tracing for Windows (ETW) records showing privileged API calls from low-integrity .NET processes

Detection Strategies

Audit Windows Security event logs for privilege use events (Event IDs 4672, 4673, 4674) tied to non-administrative users
Correlate .NET process telemetry with token elevation and access-check failures using EDR or Sysmon
Hunt for anomalous parent-child process chains where a low-privileged .NET application spawns processes with elevated tokens

Monitoring Recommendations

Continuously monitor .NET runtime versions across the fleet and flag hosts missing the Microsoft patch
Alert on local privilege escalation indicators surfaced by behavioral identification engines
Forward authentication, authorization, and process creation events to a centralized SIEM for retroactive hunting

How to Mitigate CVE-2026-45490

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45490 to all affected systems
Inventory all hosts running .NET and prioritize patching servers and multi-user systems
Restrict local logon rights and minimize the number of interactive users on critical hosts

Patch Information

Microsoft has released a security update addressing CVE-2026-45490. Administrators should consult the Microsoft Security Update CVE-2026-45490 advisory for affected .NET versions and the corresponding patched builds. Apply updates through Windows Update, Microsoft Update Catalog, or the relevant package manager for cross-platform .NET installations.

Workarounds

Enforce least-privilege policies and remove unnecessary local accounts on systems running .NET workloads
Apply Windows User Account Control (UAC) and AppLocker policies to constrain unauthorized .NET binary execution
Isolate untrusted workloads that depend on .NET runtimes using container or VM boundaries until the patch is deployed

bash

# Example: list installed .NET SDKs and runtimes to confirm patched versions
dotnet --list-sdks
dotnet --list-runtimes