Microsoft releases .NET runtime patches for high-severity symlink privilege escalation

Microsoft has released security updates for its .NET runtime environments to address a high-severity elevation of privilege vulnerability. The flaw, identified as CVE-2026-96225, affects applications running on Linux and macOS systems and allows local attackers to gain higher-level access.

What happened

The Microsoft Security Update Guide describes CVE-2026-96225 as an improper link resolution issue within the .NET framework. This vulnerability, classified as high severity with a CVSS score of 7.8, stems from insecure handling of Unix named-mutex and shared-memory paths. Attackers can exploit symlink races and unsafe permission changes in global directories to truncate or overwrite files. According to the advisory, this manipulation allows an authorized local attacker to widen directory permissions or elevate their privileges. The flaw is tracked as CWE-59, which relates to improper link resolution before file access.

The issue impacts multiple versions of the Microsoft.NETCore.App.Runtime packages. Affected versions include .NET 8.0.0 through 8.0.31, .NET 9.0.0 through 9.0.20, .NET 10.0.0 through 10.0.12, and .NET 11 preview releases up to 11.0.0-rc.1. Microsoft has provided patched versions for all these branches, including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2. The vulnerability applies to all architectures on Linux and macOS, including ARM, ARM64, x64, and musl variants.

Why it matters

This vulnerability poses a direct risk to systems where untrusted users can interact with .NET applications. Because the attack vector is local, any user with account access could potentially exploit the flaw to gain elevated rights. The ability to overwrite files or change permissions undermines the integrity of the operating system and the applications running on it. For organizations using .NET on Linux or macOS, this represents a significant security gap if systems are not updated. The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.

What to watch

• Monitor official Microsoft channels for any new advisories related to .NET runtime vulnerabilities.
• Check for additional patches if you are using older, unsupported versions of the .NET framework.
• Review application logs for unusual file access or permission changes on affected systems.
• Verify that all development and production environments are using the patched runtime versions.

Who needs to act first

Teams should prioritize updating systems that host .NET applications accessible to multiple users. Focus on servers and workstations where local users have the ability to create or modify files in shared directories. Update production environments first, then move to development and testing systems. Ensure that updates are tested in a non-production environment to verify application compatibility. Back up critical data before applying runtime updates to prevent potential service disruptions. Communicate the maintenance window to stakeholders to minimize operational impact.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Microsoft

• Inventory all systems running .NET 8, 9, 10, or 11 on Linux or macOS.
• Verify current runtime versions against the affected ranges listed in the advisory.
• Apply the patched versions available from Microsoft’s official package repositories.
• Monitor system logs for signs of exploitation after updating to ensure stability.

Step-by-step guide: Spot Privilege Escalation Warning Signs Before Breach

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which .NET versions are affected by CVE-2026-96225?

Versions 8.0.0 through 8.0.31, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, and 11.0.0-preview.1 through 11.0.0-rc.1 are affected.

Is there a patch available for this vulnerability?

Yes, Microsoft has released patched versions including 8.0.32, 9.0.21, 10.0.13, and 11.0.0-rc.2.

What platforms are impacted by this security flaw?

The vulnerability affects all architectures on Linux and macOS systems running the affected .NET runtime versions.