Vulnerabilities
CVE-2026-70190: .NET Elevation of Privilege Vulnerability – No New Fix Required
CVE‑2026‑70190 is an elevation‑of‑privilege flaw in .NET 11.0 that was already addressed in earlier releases. Microsoft has updated its Security Updates table to include KB article links for .NET 11.0 and Visual Studio, but the fixed builds remain unchanged. Defenders should confirm that their systems run the latest patched .NET 11.0 and Visual Studio versions and apply any pending KB updates.
What Happened
CVE‑2026‑70190 is an elevation‑of‑privilege vulnerability discovered in .NET 11.0. The flaw allows an attacker to gain higher privileges on a system that hosts a vulnerable .NET application.
Impact
Once exploited, an attacker could execute arbitrary code with elevated rights, potentially compromising the host machine and any services running on it. The vulnerability is mitigated in the patched builds already released.
What to Do
- Verify that your .NET runtime is at the latest patched version (currently 11.0.x with the CVE fix).
- Confirm that Visual Studio installations are updated to the latest release and that the associated KB articles are applied.
- Check the Microsoft Security Updates table for the relevant KB article links and ensure they are installed.
- Run a quick audit of systems that may host .NET applications to confirm patch compliance.
Additional Resources
Microsoft Security Advisory: CVE‑2026‑70190 – see the Security Updates table for KB links.
Related vulnerabilities
CVE‑2026‑69439: .NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft has disclosed a critical elevation‑of‑privilege flaw in the .NET runtime and Visual Studio that can allow local attackers to gain higher privileges. The issue affects multiple .NET Framework and .NET Core versions as well as Visual Studio installations. Defenders should apply the latest Microsoft security updates immediately.
Read briefing
CVE-2026-50400: Windows App Package Installer Elevation of Privilege Vulnerability
Microsoft has acknowledged CVE-2026-50400, an elevation of privilege flaw in the Windows App Package Installer. The vulnerability can be exploited by local attackers to gain higher privileges on affected systems. Defenders should verify patch status and consider disabling the App Installer if not required.
Read briefing
Adobe Releases Patches for Nine Critical Connect Flaws and Six AEM Forms Vulnerabilities
Adobe has issued updates that fix nine critical defects in Adobe Connect and six critical flaws in AEM Forms, all capable of enabling arbitrary code execution or privilege escalation. The patches address SQL injection, XSS, SSRF, and path traversal issues. Defenders should apply the updates immediately and verify affected versions.
Read briefing
Debian Linux Kernel Vulnerabilities: Privilege Escalation, Data Breach, DoS – Immediate Update Required
Multiple kernel CVEs (CVE-2024-52560, CVE-2024-58094, CVE-2024-58095, CVE-2025-21817, CVE-2025-22104, CVE-2025-22108, CVE-2025-22127, CVE-2025-38203, CVE-2025-38205, CVE-2025-38206) affect Debian trixie kernels older than 6.12.111-1, enabling privilege escalation, confidentiality loss, and denial of service. Apply the Debian security bulletin msg00441 updates immediately and verify kernel version.
Read briefing