CVE-2026-70165: .NET Privilege Escalation Vulnerability

CVE-2026-70165 Overview

CVE-2026-70165 is a local elevation of privilege vulnerability in Microsoft .NET caused by improper link resolution before file access [CWE-59]. An authorized attacker can abuse symbolic or hard links to redirect privileged file operations to unintended targets. Successful exploitation lets the attacker gain higher privileges on the affected host.

The weakness requires local access, low privileges, and user interaction, which raises the practical bar for exploitation. Microsoft published the advisory on October 13, 2026, and the National Vulnerability Database updated the entry on October 14, 2026.

Critical Impact
A local, authenticated attacker can elevate privileges on systems running affected .NET components by exploiting link-following behavior during file access.

Affected Products

Microsoft .NET (versions identified in the Microsoft Security Response Center advisory)
Windows hosts running vulnerable .NET runtime or SDK builds
Applications and services that invoke .NET file-handling APIs with elevated privileges

Discovery Timeline

2026-10-13 - Microsoft published the CVE-2026-70165 advisory
2026-10-13 - CVE-2026-70165 published to the National Vulnerability Database
2026-10-14 - Last updated in the NVD database

Technical Details for CVE-2026-70165

Vulnerability Analysis

The vulnerability is a link-following flaw in .NET file-handling logic. The affected code accesses a file path without fully resolving or validating that the path is a symbolic link, junction, or hard link. An attacker who controls part of the target directory can replace a legitimate file or path element with a link that points to a sensitive location. When the privileged .NET process performs the file operation, it acts on the attacker-chosen target instead.

Exploitation requires local access and prior authentication at a low privilege level. User interaction is also required, which typically means the victim must execute a specific action such as launching an installer or running a tool. The confidentiality, integrity, and availability impacts are all high because the attacker ends up performing file reads, writes, or deletions in a security context above their own.

Root Cause

The root cause is improper link resolution before file access [CWE-59]. The vulnerable code path trusts a filesystem path without canonicalizing it or verifying that each component is not a reparse point under attacker control. This creates a classic link-following primitive that converts a benign file operation into a privileged write or overwrite against an arbitrary target.

Attack Vector

The attack vector is local. An attacker first stages a working directory that contains a link redirecting to a protected file or directory. The attacker then triggers a privileged .NET workflow, such as an installer, update routine, or scheduled task, that touches the staged path. The privileged process follows the link and reads from or writes to the attacker-chosen target, allowing privilege escalation. Refer to the Microsoft CVE-2026-70165 Advisory for the exact affected components and build numbers.

Detection Methods for CVE-2026-70165

Indicators of Compromise

Creation of symbolic links, junctions, or hard links in directories writable by standard users but accessed by privileged .NET processes.
Unexpected file writes or ACL changes on protected system paths performed by dotnet.exe, installer processes, or .NET service accounts.
Suspicious use of mklink, CreateSymbolicLink, or NTFS reparse point APIs from non-administrative user sessions.

Detection Strategies

Monitor for reparse point creation events (Windows event ID 4663 with reparse metadata) immediately followed by elevated file operations on the same path.
Correlate standard-user processes creating links with subsequent file access by SYSTEM or service-tier .NET processes.
Alert on .NET processes writing to directories outside their expected working set, especially under C:\ProgramData, C:\Windows, or Program Files.

Monitoring Recommendations

Enable object access auditing on directories used by .NET installers, updaters, and services.
Collect process and file telemetry from endpoints into a central data lake for cross-process correlation.
Baseline normal link usage per host so new reparse points stand out in detection logic.

How to Mitigate CVE-2026-70165

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-70165 Advisory to all affected .NET runtimes and SDKs.
Inventory hosts running .NET and prioritize patching for servers that execute .NET workloads with elevated privileges.
Restrict interactive and remote desktop access on systems where privileged .NET tasks run.

Patch Information

Microsoft has released updates for the affected .NET components. Review the Microsoft CVE-2026-70165 Advisory for the specific .NET versions, Knowledge Base articles, and build numbers that address this vulnerability. Deploy the patches through Windows Update, Microsoft Update Catalog, or your standard package management workflow.

Workarounds

Remove unnecessary write permissions from directories that privileged .NET processes read from or write to.
Disable or restrict the SeCreateSymbolicLinkPrivilege for standard users where business workflows allow.
Run .NET workloads with the minimum privileges required and avoid executing elevated .NET tools from user-writable directories.

bash

# Example: audit which principals hold symbolic link creation rights
whoami /priv | findstr SeCreateSymbolicLinkPrivilege

# Example: remove inherited write access for standard users on a sensitive directory
icacls "C:\ProgramData\VendorApp" /inheritance:d
icacls "C:\ProgramData\VendorApp" /remove:g "BUILTIN\Users"