Skip to content
OpenAdvisories
High MSRC-CVE-2026-35433 1 CVE

.NET Elevation of Privilege Vulnerability

Published May 12, 2026 · Updated Jun 17, 2026 · Revision 4

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of this vulnerability requires that a user trigger the payload in the application.

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could view sensitive information (Confidentiality) and modify code in the repo, (Integrity), and they might be able to interfere with availability of the code (Availability).

Security updates
10.0.8 — https://support.microsoft.com/help/5093446
8.0.27 — https://support.microsoft.com/help/5093447
9.0.16 — https://support.microsoft.com/help/5093448
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087065
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087067
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087063
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087066
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087068
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087064
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087061
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087059
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087053
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087051
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087055
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087058
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087054
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087048
4.8.9334.0 and 4.8.4802.0 — https://support.microsoft.com/help/5087049

Vulnerabilities 1

Revision history

  1. #4

    This CVE was updated to remove Windows 11 (21H1 and 22H2) as impacted

  2. #3

    This CVE was updated to fix the download links for .NET Framework 3.8 & 4.81 installed on Windows Server 2025. Microsoft recommend installing the security update if you haven't done so already.

  3. #2

    Updated links to the .NET Framework security updates. Customers running these versions of .NET Framework are encouraged to install the updates for the indicated versions to be protected from this vulnerability.

  4. #1

    Information published.

References