Key points
- CVE-2026-96225 is rated high severity with a CVSS score of 7.8.
- The flaw affects .NET runtime versions 8.0 through 11.0 preview releases.
- Microsoft provides patched versions for Linux and macOS platforms only.
Microsoft has released security updates for the .NET runtime to address a high-severity vulnerability that allows local attackers to elevate privileges on Linux and macOS systems. The flaw, tracked as CVE-2026-96225, stems from improper link resolution before file access. This issue affects multiple major versions of the .NET Core application runtime, requiring administrators to update their environments to mitigate the risk of unauthorized access.
How it unfolded
- Microsoft published an advisory describing CVE-2026-96225 as an elevation of privilege vulnerability.
- The company identified improper link resolution in .NET as the root cause of the flaw.
- Updates were released for .NET versions 8, 9, 10 and 11 preview builds.
- The vulnerability was assigned a CVSS 3.1 score of 7.8, categorized as high severity.
Who is affected
The vulnerability impacts Microsoft .NET projects using specific package versions on Linux and macOS platforms. According to the Microsoft Security Update Guide, the flaw affects all architectures on these operating systems. Windows systems are not listed as affected in the advisory. The issue allows an authorized attacker to elevate privileges locally by exploiting insecure global directories and symlink races in Unix named-mutex and shared-memory paths.
What happens next
Microsoft has provided patched versions for all affected .NET runtime packages. For .NET 8, the fix is available in version 8.0.32. .NET 9 users should update to version 9.0.21. .NET 10 requires version 10.0.13, while .NET 11 preview users must move to version 11.0.0-rc.2. These updates address the improper link resolution issue across all supported Linux and macOS architectures.
The background in plain language
Symlinks act as shortcuts that point to other files or directories. A race condition occurs when two processes try to access a resource simultaneously, creating a window for manipulation. In this case, an attacker can swap a legitimate file with a malicious one during access. Privilege escalation happens when a user gains higher system permissions than intended. Teams usually monitor for unexpected permission changes and restrict access to global directories to prevent such exploits.
Background: Unauthorized access
Yes, they are different. Unauthorized access means entering a system without permission. Unauthorized use means entering with permission but acting beyond allowed boundaries. Access violations trigger perimeter alerts. Use violations require behavioral analysis to detect, as the actor already possesses valid credentials and expected network presence.
Read the full guide: Difference Between Unauthorized Access and Unauthorized Use Explained
What to do and how to stay safe: Microsoft
- Check your current .NET runtime version against the affected ranges listed in the advisory.
- Apply the latest patched updates to your Linux and macOS systems as soon as possible.
- Monitor system logs for unusual file access or permission changes in global directories.
- Review application configurations to ensure proper link resolution practices are in place.
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which operating systems are affected by CVE-2026-96225?
The vulnerability affects Linux and macOS systems running affected versions of the .NET runtime.
What is the CVSS score for this vulnerability?
The CVSS 3.1 score is 7.8, which Microsoft rates as high severity.
Is there a fix available for Windows systems?
The advisory does not list Windows as an affected platform for this specific vulnerability.
