CVE-2026-70190

Overview

.NET is a free, open-source, cross-platform framework for building modern apps and powerful cloud services. It consists of a runtime and a developer platform made up of tools, programming languages, and libraries for building many different types of applications.

An elevation of privilege vulnerability (CVE-2026-70190) has been identified in the .NET SDK's elevated workload installer on Windows, which can follow a junction or symbolic link under %ProgramData%\dotnet and lets a local user get an installer of their choosing run with administrator rights. Microsoft's advisory lists only the .NET SDK 10.0 feature bands and the 11.0 previews as affected; .NET 6 is past end of life and is not assessed there, and HeroDevs confirmed that the .NET 6 SDK has the same weakness.

Per CWE-59: Improper Link Resolution Before File Access ('Link Following'), the weakness is a product that accesses a file based on its filename but does not properly prevent that name from resolving to a link that points outside the intended control sphere.

This issue affects the .NET 6 SDK on Windows, including the End-of-Life .NET 6.0 line covered by NES, on machines where workloads are installed in MSI mode through an elevated dotnet workload command. Linux and macOS are not affected, and application runtimes are not affected.

Details

Module Info

• Product: .NET SDK
• Affected packages: .NET SDK workload installation (NetSdkMsiInstallerServer and the workload MSI package cache)
• Affected versions:
  
  • .NET SDK >= 6.0.100 <= 6.0.437 (Windows)
• Package manager: Windows Installer, archives (.zip)
• GitHub repository: https://github.com/dotnet/sdk
• Published packages: Download .NET (Linux, macOS, and Windows)
• Fixed in:
  
  • NES for .NET 6.0.47 (.NET SDK 6.0.438)

Vulnerability Info

This High-severity vulnerability is found in the Windows workload installer of the .NET SDK. When workloads are installed as MSIs, the SDK caches each package under %ProgramData%\dotnet and hands it to an elevated server process, NetSdkMsiInstallerServer, to install. A standard user can create that folder. The 6.0 SDK secured the folder only when it did not exist yet, and the elevated install only checked that the package path was textually under the cache. A user who created the folder first, or replaced it with a junction, could get an MSI of their choosing installed with administrator rights the next time an administrator ran a workload command.

The fix checks the folder before anything is cached and before every elevated install. The folder must be owned by Administrators or SYSTEM, must not be a junction or other reparse point, and must not let anyone else modify it. An untrusted folder is rejected rather than repaired. The cached MSI is also now owned by Administrators instead of the user who started the install. Folders created by an elevated unpatched 6.0 SDK pass the check, so existing installations keep working. CVE-2026-70161 and CVE-2026-70190 are addressed together by the same workload hardening in NES for .NET 6.0.47.

This vulnerability has been present since at least .NET SDK 6.0.

Mitigation

.NET 6 is End-of-Life and will not receive any updates from Microsoft to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a supported .NET SDK, one of:
  
  • .NET SDK 10.0.113 or later (10.0.1xx feature band)
  • .NET SDK 10.0.402 or later (10.0.4xx feature band)
• Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES for .NET 6.0.47 (.NET SDK 6.0.438) or later. If the patched SDK reports that %ProgramData%\dotnet is untrusted, delete the folder and retry.

Credits

Coşkun Bağrıaçık, as credited in Microsoft's advisory.