CVE-2026-70190: .NET Link Following Privilege Escalation

CVE-2026-70190 Overview

CVE-2026-70190 is an elevation of privilege vulnerability in Microsoft .NET caused by improper link resolution before file access ([CWE-59]). An authorized local attacker can abuse symbolic or hard links to coerce the runtime into accessing files outside the intended path, resulting in local privilege escalation. The flaw requires low privileges and user interaction, but yields high impact to confidentiality, integrity, and availability on the affected host.

Critical Impact
A local, authenticated attacker can elevate privileges on a system running a vulnerable .NET component by substituting attacker-controlled links for files the runtime trusts.

Affected Products

Microsoft .NET (version details published in the Microsoft Security Update Guide)
Workloads and applications built on vulnerable .NET runtime versions
Windows hosts where privileged .NET processes resolve attacker-writable paths

Discovery Timeline

2026-10-13 - CVE-2026-70190 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-70190

Vulnerability Analysis

The vulnerability resides in how .NET resolves file system links prior to opening or operating on a target file. When a privileged .NET process accesses a path that an unprivileged user can control, the runtime follows the link without verifying the resolved target. An attacker plants a symbolic link or junction that redirects the operation to a sensitive file. The process then reads, writes, or replaces that target under its own elevated context.

Exploitation requires local access with low privileges and some user interaction, such as triggering a scheduled task, installer action, or administrative operation that invokes the vulnerable code path. Successful exploitation yields full read, write, and execution influence over resources the targeted process can access.

Root Cause

The root cause is a classic link following weakness classified under [CWE-59]. The .NET component performs file operations without canonicalizing the final resolved path or validating that intermediate components are not attacker-controlled links. This creates a window where path resolution and the subsequent file access diverge in trust assumptions.

Attack Vector

The attack vector is local. An unprivileged user stages a symbolic link, junction, or hard link in a directory the vulnerable .NET process writes to or reads from. When the privileged process executes the file operation, it follows the link into a protected location. The attacker can overwrite system files, plant DLLs for later loading, or disclose sensitive data to gain SYSTEM-level privileges.

No verified public exploit code is available at this time. Refer to the Microsoft Security Update Guide for CVE-2026-70190 for technical details.

Detection Methods for CVE-2026-70190

Indicators of Compromise

Creation of symbolic links, junctions, or hard links in directories used by .NET processes running at elevated integrity.
Unexpected file writes to protected locations (%ProgramFiles%, %SystemRoot%, %ProgramData%) by dotnet.exe or a .NET-hosted service.
File modifications where the acting process runs as SYSTEM or an administrator while the source path is user-writable.

Detection Strategies

Monitor Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateTime) for link creation under user-writable directories later accessed by privileged .NET processes.
Correlate mklink, CreateSymbolicLink, or CreateHardLink API usage with subsequent file operations by elevated .NET components.
Alert on privileged file writes where the process image is dotnet.exe, w3wp.exe, or custom .NET services targeting paths outside their expected working directory.

Monitoring Recommendations

Enable Windows object access auditing on sensitive directories touched by .NET installers, services, and scheduled tasks.
Track .NET runtime version inventory to prioritize hosts still exposed to the vulnerable component.
Review scheduled tasks and services that execute .NET binaries under elevated contexts for unexpected path dependencies.

How to Mitigate CVE-2026-70190

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-70190 to all affected .NET runtimes and SDKs.
Inventory applications bundling private .NET runtimes and update them to patched versions.
Restrict interactive logon and local account provisioning on servers running privileged .NET workloads.

Patch Information

Microsoft published the fix in the Security Update Guide entry for CVE-2026-70190. Administrators should install the corresponding .NET runtime and SDK updates via Microsoft Update, the standalone installers, or their package management pipeline. Self-contained .NET applications must be rebuilt against patched runtime binaries.

Workarounds

Remove write permissions for low-privilege users on directories consumed by elevated .NET processes.
Disable or control symbolic link creation for non-administrators by auditing the SeCreateSymbolicLinkPrivilege assignment.
Run .NET services with the least privilege required and isolate working directories from user-writable paths.

bash

# Review which principals hold the symbolic link creation privilege
whoami /priv | findstr /i SeCreateSymbolicLinkPrivilege

# Enumerate assignment via secedit for hardening review
secedit /export /cfg C:\Temp\secpol.cfg
findstr /i SeCreateSymbolicLinkPrivilege C:\Temp\secpol.cfg