Update .NET 8-11 on Linux/macOS to fix CVE-2026-96231 local privilege escalation

Microsoft has released security updates to address CVE-2026-96231, a high-severity elevation of privilege vulnerability in the .NET runtime environment. According to the Microsoft Security Update Guide, the flaw allows an authorized attacker to elevate privileges locally by exploiting improper link resolution before file access. This issue impacts systems running Linux and macOS, requiring immediate attention from administrators managing these platforms.

The GitHub advisory identifies the root cause as insecure handling of Unix named-mutex and shared-memory paths. Attackers can manipulate these paths through symlink races and unsafe permission changes in global directories. This manipulation enables local users to truncate or overwrite files, widen directory permissions, or achieve privilege escalation. The vulnerability is present in multiple .NET runtime packages across several major version lines.

Affected Versions and Platforms

The vulnerability affects Microsoft.NETCore.App.Runtime packages for Linux and macOS architectures. According to the GitHub advisory, .NET 8.0 versions from 8.0.0 through 8.0.31 are vulnerable, with 8.0.32 providing the fix. Similarly, .NET 9.0 versions from 9.0.0 through 9.0.20 require an update to 9.0.21. The issue also impacts .NET 10.0 versions from 10.0.0 through 10.0.12, which are resolved in 10.0.13.

Preview releases of .NET 11.0 are also affected. The advisory lists versions from 11.0.0-preview.1 through 11.0.0-rc.1 as vulnerable. The fix is available in version 11.0.0-rc.2. All listed packages cover various Linux distributions including musl-based systems, as well as macOS on both ARM64 and x64 architectures. Users should verify their specific runtime version against these ranges.

What to watch

Administrators should prioritize updating affected .NET runtimes to the patched versions listed above. Monitor internal logs for unusual permission changes or file truncation events on Linux and macOS servers. Verify that all development and production environments are running the latest secure runtime versions. Keep an eye on Microsoft’s security advisory pages for any further developments regarding this vulnerability or related issues in the .NET ecosystem.

What made it possible

This class of vulnerability relies on the operating system's handling of symbolic links in shared directories. Teams usually encounter this when applications assume file paths are static and safe. Check whether your applications validate file targets before accessing them. Attackers often exploit race conditions where a link is swapped between creation and access. Understanding this mechanism helps in recognizing similar risks in other system interactions.

Background: Privilege escalation vulnerabilities

Remove local administrator rights from daily users and enforce strict application whitelisting. These two steps block the majority of local privilege escalation attempts. Disable unused services and update dependencies to close known pathways that attackers use to gain higher system access.

Read the full guide: Stop Privilege Escalation: 5 Actions to Block Local Attacks

What to do and how to stay safe: Microsoft

• Identify all servers and workstations running vulnerable .NET runtime versions on Linux or macOS.
• Apply the latest security updates to .NET 8, 9, 10, and 11 preview environments immediately.
• Review file permissions in global directories to limit unauthorized modification of shared resources.
• Monitor system logs for signs of privilege escalation or unexpected file changes post-patch.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96231?

The vulnerability has a CVSS score of 7.8, which is rated as high severity.

Which operating systems are affected by this .NET vulnerability?

Linux and macOS are the affected operating systems for this privilege escalation flaw.

Is there a fix available for .NET 8.0?

Yes, Microsoft has released version 8.0.32 to patch the vulnerability in .NET 8.0.