Skip to content
OpenAdvisories
High MSRC-CVE-2026-32177 1 CVE

.NET Elevation of Privilege Vulnerability

Published May 12, 2026 · Updated Jun 19, 2026 · Revision 5

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain ELEVATED privileges, which may allow them to perform actions beyond their original permissions.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could view sensitive information (Confidentiality) and modify code in the repo, (Integrity), and they might be able to interfere with availability of the code (Availability).

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of this vulnerability requires that a user trigger the payload in the application.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could view sensitive information such as other user's credentials (Confidentiality) and make changes to file contents on the target server (Integrity), and they might be able to force a crash (Availability).

Security updates
10.0.8 — https://support.microsoft.com/help/5093446
8.0.27 — https://support.microsoft.com/help/5093447
9.0.16 — https://support.microsoft.com/help/5093448
17.12.20 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes-v17.12
17.14.32 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
18.5.3 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087065
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087067
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087069
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087066
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087068
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087064
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087061
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087062
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087063
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087059
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087053
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087051
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087055
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087058
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087054
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087048
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087049

Vulnerabilities 1

Revision history

  1. #5

    Removed incorrectly added rows from the Security Updates table. This is an informational change only.

  2. #4

    This CVE was updated to fix the download links for .NET Framework 3.8 & 4.81 installed on Windows Server 2025. Microsoft recommend installing the security update if you haven't done so already.

  3. #3

    Removed incorrectly added rows from the Security Updates table. This is an informational change only.

  4. #2

    Updated links to the .NET Framework security updates. Customers running these versions of .NET Framework are encouraged to install the updates for the indicated versions to be protected from this vulnerability.

  5. #1

    Information published.

References