CVE-2026-45490: .NET SDK Elevation of Privilege Vulnerability

Synopsis

An improper authorization vulnerability in the .NET SDK allows a local attacker with a low-privilege account to elevate their privileges on the affected host. The vulnerability is reachable only with an existing local session and does not require any user interaction. Successful exploitation gives the attacker full read, write, and availability control over resources on the affected system. Patched-image rebuilds at .NET versions 8.0.28, 9.0.17, and 10.0.9 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  The attacker must be authenticated to the local system; any low-privilege account is sufficient to attempt exploitation.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker can trigger the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other variable environmental factors.

Blast Radius

• A successful attacker reads sensitive files and data accessible to higher-privilege processes on the host, including credentials or configuration secrets.
• The attacker writes or modifies files and system state outside the bounds of their original low-privilege account.
• The attacker can disrupt or terminate processes and services on the host, causing a denial of service for workloads running on the same system.
• All three impact dimensions (confidentiality, integrity, and availability) are rated HIGH, meaning the attacker gains effective full control over the affected host context.