PT-2026-24333 · Microsoft+1 · .Net Framework+1

Igor Kovalchuk · Published 2026-03-10 · Updated 2026-05-21 · CVE-2026-26131

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions .NET (affected versions not specified)

Description A flaw in .NET allows an authorized attacker to gain elevated privileges on a local system. The March 2026 Patch Tuesday addressed this issue, fixing 79 flaws including two zero-day vulnerabilities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2026-02867

BIT-DOTNET-2026-26131

BIT-DOTNET-SDK-2026-26131

CVE-2026-26131

GHSA-387C-QMRW-59QV

GHSA-CRJQ-WM6X-6QX7

RHSA-2026:9077

Affected Products

.Net Framework

Red Os

References · 23

• https://bdu.fstec.ru/vul/2026-02867 · Security Note
• https://osv.dev/vulnerability/GHSA-387c-qmrw-59qv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26131 · Security Note
• https://osv.dev/vulnerability/BIT-dotnet-2026-26131 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26131 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26131 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-dotnet-sdk-2026-26131 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-crjq-wm6x-6qx7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26131 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-26131 · Security Note
• https://github.com/dotnet/runtime · Note
• https://github.com/dotnet/runtime/security/advisories/GHSA-crjq-wm6x-6qx7 · Note
• https://github.com/dotnet/announcements/issues/386 · Note
• https://github.com/dotnet/dotnet · Note
• https://twitter.com/DigitpatroxOff/status/2031558238152307157 · Twitter Post