CVE-2026-65810

.NET Framework is like a common set of building blocks that many Windows apps rely on. This vulnerability lets an attacker locally trick .NET into stepping outside its intended “folder area” by manipulating file paths, which can then help them gain higher permissions on the machine. Think of it as someone convincing a program to open “the next folder up” instead of only the allowed folder.

This matters if you run Windows software that uses Microsoft .NET Framework—especially .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8, or 4.8.1—on any machine that could be accessed by a user or a low-privilege account.

Reachability: it’s a local issue (requires an attacker on the machine), and the findings indicate user interaction is required; authentication is not required. So the practical risk is highest on systems where an attacker can get local access and trigger the vulnerable behavior.

This should be treated as urgent because it’s a local privilege-escalation flaw in widely used .NET Framework components, and patch updates are available with specific fixed versions. Press reporting has highlighted active, high-profile exploitation activity around the same August 2026 Patch Tuesday cycle (though it does not clearly tie that reporting to this exact CVE), and security attention has been drawn to the issue.

Even without public exploit code, a RED verdict means you should prioritize patching on all affected machines rather than waiting.

1. Identify affected machines

   • Inventory all Windows endpoints and servers that run apps depending on Microsoft .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8, or 4.8.1.
   • For each device, record the installed .NET Framework versions (both the base version and the relevant update level for your branch).

2. Confirm whether you’re already fixed

   • Compare the installed .NET Framework component versions to Microsoft’s fixed versions for CVE-2026-65810:
     • .NET Framework 3.5 → fixed in 2.0.50727.9183 & 3.0.30729.9169
     • .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 → fixed in 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4144.0
     • .NET Framework 3.5 AND 4.7.2 → fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.7.4144.0
     • .NET Framework 3.5 AND 4.8 → fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4805.0
     • .NET Framework 3.5 AND 4.8.1 → fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9343.0
     • .NET Framework 4.6.2/4.7/4.7.1/4.7.2 → fixed in 4.7.4144.0
     • .NET Framework 4.8 → fixed in 4.8.4805.0
     • .NET Framework 4.8.1 → fixed in 4.8.9344.0

3. Upgrade / patch

   • Apply the Microsoft update(s) referenced in the Microsoft update guide for CVE-2026-65810.
   • Reboot if your patch process requires it, then re-check the installed .NET Framework file/component versions to ensure they match or exceed the fixed versions above.

4. Temporary workaround if patching is delayed

   • Because the issue is local and user-interaction based, reduce the chance of a malicious local user triggering the vulnerable behavior:
     • limit which accounts can interactively use the affected machines
     • remove unnecessary user accounts / tighten physical and session access
     • prioritize patching for systems exposed to guests, shared workstations, or users with broader access

5. Monitor after patching

   • Watch for unusual file access or unexpected privilege changes on patched machines.
   • If you manage centralized logging, look for indicators of local compromise around the timeframe patches are applied (exact indicators are not provided in the findings, so focus on local-access anomalies).

Severity and posture: CVSS 7.8 (HIGH). The weakness is categorized as CWE-23 (Relative Path Traversal). The core mechanism described in the findings is that an attacker can manipulate relative path inputs to cause .NET Framework to read or write files outside the intended directory, leading to privilege escalation.

Attack prerequisites and reachability: Findings indicate local attack vector, no authentication required, and user interaction required. The findings also note that reachability in default configuration is unknown, so exposure depends on whether the vulnerable path-handling behavior can be reached in your environment.

Exploitation signals: KEV listings are not present for this CVE, and there is no clear dated press claim identifying CVE-2026-65810 as actively exploited. However, there is press attention related to patch activity in August 2026 Patch Tuesday and mentions of a high-profile actor (Lazarus group) in the context of the broader patch cycle.

Fix availability: Microsoft provides fixed version levels for each affected .NET Framework branch, as listed in the findings. Apply the correct fixed version(s) for your installed .NET Framework components to eliminate the vulnerable path-handling behavior.