Executive brief
.NET is a widely used software development platform by Microsoft. A vulnerability in how .NET handles file names and paths could allow an attacker to gain elevated privileges on a system through a network attack, potentially compromising sensitive applications and data.
Technical details
This vulnerability involves external control of file name or path (CWE-73) in Microsoft .NET. An unauthorized attacker can exploit this flaw over the network to elevate privileges on an affected system. The vulnerability likely stems from insufficient input validation or improper canonicalization of file paths, allowing an attacker to manipulate file operations in unintended ways. Network-based attack vector suggests the flaw can be triggered remotely without requiring local access or special privileges, though specific preconditions and patch availability require further clarification from Microsoft's official advisory.
Affected products
- Microsoft .NET
Timeline
- 2026-09-08: disclosed