CVE-2026-45491: .NET Auth Bypass Vulnerability

CVE-2026-45491 Overview

CVE-2026-45491 is an improper link resolution vulnerability (CWE-59) in Microsoft .NET. The flaw allows an unauthorized local attacker to perform tampering by abusing symbolic or hard link handling before file access. Successful exploitation impacts integrity without requiring privileges or user interaction. Microsoft published an advisory tracking this issue under the Microsoft Security Response Center update guide.

Critical Impact
A local attacker can manipulate file targets through link following to tamper with files that the affected .NET process accesses, undermining data integrity on the host.

Affected Products

Microsoft .NET (see vendor advisory for affected version ranges)
Applications and services built on the affected .NET runtime
Windows hosts running affected .NET workloads

Discovery Timeline

2026-06-09 - CVE-2026-45491 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45491

Vulnerability Analysis

The vulnerability stems from improper link resolution before file access in .NET. When the runtime or a .NET component opens, writes, or modifies a file by path, it fails to safely resolve filesystem links before performing the operation. A local attacker who can create or control links in a path traversed by the .NET process can redirect the operation to a different target file. The result is tampering with files the attacker would not normally be able to modify directly. The flaw does not yield code execution or information disclosure on its own, but it produces a high integrity impact according to the CVSS vector.

Root Cause

The root cause is a classic link following weakness categorized as [CWE-59]. The affected code path trusts the resolved filesystem path without verifying that intermediate or terminal components are not attacker-controlled symbolic links, junctions, or hard links. This time-of-check to time-of-use style gap lets a local user substitute a link that points to a sensitive target before the .NET process performs its write or modify operation.

Attack Vector

Exploitation requires local access to the host. The attacker plants a symbolic link, junction, or hard link in a directory that the vulnerable .NET process subsequently writes to. When the process opens the path, it follows the link and modifies the attacker-chosen file. No authentication or user interaction is required by the vulnerable component, and the EPSS probability is 0.092%, reflecting low observed exploitation activity to date.

No verified exploitation code is publicly available. Refer to the Microsoft CVE-2026-45491 Advisory for vendor technical details.

Detection Methods for CVE-2026-45491

Indicators of Compromise

Unexpected symbolic links, NTFS junctions, or hard links in directories used by .NET applications, service accounts, or installer working paths.
File modification events on sensitive files whose immediate writer is a dotnet.exe or .NET host process rather than the expected owner.
Creation of links by low-privilege users immediately before a higher-privilege .NET process accesses the same directory.

Detection Strategies

Hunt for CreateSymbolicLink, mklink, or CreateHardLink activity originating from non-administrative users in paths consumed by .NET services.
Correlate file write events from .NET processes against the effective target path after link resolution to identify redirection.
Review audit logs for tampering of configuration, log, or binary files writable through .NET service paths.

Monitoring Recommendations

Enable Windows object access auditing on directories used by .NET-based services and scheduled tasks.
Track Sysmon Event ID 11 (FileCreate) and Event ID 2 (file creation time changed) for links created in privileged write paths.
Alert on file integrity changes to sensitive system or application files modified by .NET runtime processes.

How to Mitigate CVE-2026-45491

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-45491 Advisory to all affected .NET runtimes and SDKs.
Inventory hosts running .NET workloads and prioritize multi-user systems and build servers where local accounts exist.
Restrict the ability to create symbolic links to administrators on systems running privileged .NET services.

Patch Information

Microsoft addresses CVE-2026-45491 through updates distributed via the Microsoft Update Catalog and standard Windows Update channels. Consult the vendor advisory for the specific .NET runtime, SDK, and ASP.NET Core versions that contain the corrected link resolution logic, and redeploy any self-contained .NET applications using the patched runtime.

Workarounds

Remove the SeCreateSymbolicLinkPrivilege right from standard users via Group Policy where business requirements allow.
Run .NET applications under least-privilege service accounts and place their working directories on volumes not writable by interactive users.
Apply strict ACLs to directories accessed by privileged .NET processes so unauthorized users cannot stage links.

bash

# Configuration example: restrict symbolic link creation to administrators (Windows)
# secedit / Local Security Policy path:
# Computer Configuration > Windows Settings > Security Settings >
#   Local Policies > User Rights Assignment > "Create symbolic links"
# Ensure only the Administrators group is listed.

# Verify current assignment:
whoami /priv | findstr /i SeCreateSymbolicLinkPrivilege