Is CVE-2026-62909 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62909 being exploited in the wild.

How severe is CVE-2026-62909?

High severity, with a CVSS score of 7.8, published 11 August 2026.

Which products and versions are affected?

Microsoft .NET Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; and 5 more.

How is CVE-2026-62909 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-62909?

Check whether you run Apple macOS, Linux Kernel, Microsoft .NET Runtime or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-62909 · Severity: high · CVSS 7.8 · Published 2026-08-11

A security vulnerability exists in the Microsoft .NET runtime, a framework used to build and run applications on Linux and macOS. A flaw in how the system handles internal communications could allow a local user with limited access to gain higher privileges on the machine. To resolve this, organizations must update their .NET installations and redeploy any self-contained applications built with the affected versions.

Technologies: Apple macOS, Linux Kernel, Microsoft .NET Runtime, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026, Microsoft Windows, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet), Microsoft.NetCore.App.Runtime.linux-x64 (NuGet), Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet), Microsoft.NetCore.App.Runtime.osx-x64 (NuGet). Vendors: Apple, Linux, Microsoft, NuGet.

Quick answers

Is CVE-2026-62909 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62909 being exploited in the wild.
How severe is CVE-2026-62909?: High severity, with a CVSS score of 7.8, published 11 August 2026.
Which products and versions are affected?: Microsoft .NET Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.11; and 5 more.
Is there a fix for CVE-2026-62909?: Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62909 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-62909?: Check whether you run Apple macOS, Linux Kernel, Microsoft .NET Runtime or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.11

Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.11

Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.11

Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.11 or later

dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.11

Technical details

A vulnerability classified as CWE-252 (Unchecked Return Value) exists in the .NET diagnostics Inter-Process Communication (IPC) mechanism. A missing error check during the initialization of shared resources leads to the application of an improper Access Control List (ACL). A local attacker with low privileges can exploit this flaw to achieve elevation of privilege, provided there is some level of user interaction and specific timing conditions (high complexity). The issue affects .NET 8, 9, and 10 on Linux and macOS platforms. Patches are available in versions 8.0.30, 9.0.19, and 10.0.11.

Affected products

Microsoft .NET Runtime 8.0.0 - 8.0.29, 9.0.0 - 9.0.18, 10.0.0 - 10.0.10

Identifiers

CVE-2026-62909
GHSA-9mr8-pwpw-3j2w

Timeline

2026-08-11: disclosed
2026-08-11: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.