{"id":"CVE-2026-45490","aliases":["ALPINE-CVE-2026-45490","BIT-dotnet-2026-45490","BIT-dotnet-sdk-2026-45490","EUVD-2026-35674","GHSA-77gm-m6x5-jf4f","UBUNTU-CVE-2026-45490"],"status":"published","title":".NET SDK Elevation of Privilege Vulnerability","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00384,"percentile":0.32716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266","CWE-285","CWE-863"],"published":"2026-06-09T17:04:43Z","modified":"2026-11-03T06:32:55Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"dotnet10-runtime","fixed_in":["10.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dotnet10-runtime","fixed_in":["10.0.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dotnet8-runtime","fixed_in":["8.0.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dotnet8-runtime","fixed_in":["8.0.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dotnet8-runtime","fixed_in":["8.0.28-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"dotnet9-runtime","fixed_in":["9.0.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"dotnet9-runtime","fixed_in":["9.0.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"dotnet9-runtime","fixed_in":["9.0.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"dotnet9-runtime","fixed_in":["9.0.17-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["8.0.28","9.0.17","10.0.9"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["8.0.28","9.0.17","10.0.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"dotnet10-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dotnet10-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dotnet8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.28-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"dotnet9-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.17-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.28"},{"introduced":"9.0.0"},{"fixed":"9.0.17"},{"introduced":"10.0.0"},{"fixed":"10.0.9"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.28"},{"introduced":"9.0.0"},{"fixed":"9.0.17"},{"introduced":"10.0.0"},{"fixed":"10.0.9"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"dotnet7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.105-0ubuntu1~22.04.1","7.0.107-0ubuntu1~22.04.1","7.0.108-0ubuntu1~22.04.1","7.0.109-0ubuntu1~22.04.1","7.0.110-0ubuntu1~22.04.1","7.0.111-0ubuntu1~22.04.1","7.0.112-0ubuntu1~22.04.1","7.0.113-0ubuntu1~22.04.1","7.0.114-0ubuntu1~22.04.1","7.0.115-0ubuntu1~22.04.1","7.0.116-0ubuntu1~22.04.1","7.0.117-0ubuntu1~22.04.1","7.0.117-0ubuntu1~22.04.2","7.0.119-0ubuntu1~22.04.1"]}],"products":[{"vendor":"microsoft","product":".net"},{"vendor":"microsoft","product":".net 10.0"},{"vendor":"microsoft","product":".net 8.0"},{"vendor":"microsoft","product":".net 9.0"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45490","tags":["vendor-advisory","patch","Vendor Advisory","advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45490","tags":["vdb-entry","x_refsource_REDHAT","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487184","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45490.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45490","tags":["web"]},{"url":"https://github.com/advisories/GHSA-77gm-m6x5-jf4f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-45490","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45490","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45490","tags":["report"]},{"url":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-june-2026-servicing-updates","tags":["report"]},{"url":"https://github.com/dotnet/announcements/issues/403","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-45490","title":".NET SDK Elevation of Privilege Vulnerability","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T17:04:43.9Z","modified":"2026-09-24T13:43:45.793Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-285","CWE-266"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-35674","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T17:04:43Z","modified":"2026-09-24T13:43:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"high"}],"updated_at":"2026-11-02T17:27:59.112143Z"}],"ghsa":[{"id":"GHSA-77gm-m6x5-jf4f","title":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T18:30:50Z","modified":"2026-06-30T03:36:59Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-266","CWE-285","CWE-863"],"updated_at":"2026-11-02T15:09:05.34707Z"}],"nvd":[{"id":"CVE-2026-45490","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T17:17:25.447Z","modified":"2026-07-23T08:10:00.137Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-285","CWE-863","CWE-266"],"updated_at":"2026-11-02T14:12:23.109705Z"}],"osv":[{"id":"ALPINE-CVE-2026-45490","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T17:17:25.447Z","modified":"2026-11-03T06:32:55.934999431Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-45490","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T17:17:25.447Z","modified":"2026-10-24T10:30:44.348680152Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"UBUNTU-CVE-2026-45490","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-09T17:17:00Z","modified":"2026-06-30T18:18:15.309886233Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"BIT-dotnet-2026-45490","title":".NET SDK Elevation of Privilege Vulnerability","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-18T09:47:22.094Z","modified":"2026-09-08T08:46:58.687585898Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2026-45490","title":".NET SDK Elevation of Privilege Vulnerability","description":"Improper authorization in .NET allows an authorized attacker to elevate privileges locally.","status":"published","published":"2026-06-18T09:47:21.74Z","modified":"2026-09-08T08:46:48.275247355Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}