Loading story…
Microsoft published security advisories for elevation of privilege vulnerabilities affecting ASP.NET and .NET, including CVE-2023-36899 and CVE-2026-35433. The newer flaw, CVE-2026-35433, affects .NET and stems from improper input validation combined with an integer overflow or wraparound condition that can let an unauthorized attacker elevate privileges locally if a user triggers the malicious payload in an application.
Microsoft rated CVE-2026-35433 as Important with a CVSS 3.1 score of 7.3 and said successful exploitation could result in SYSTEM privileges. The company reported that the issue was neither publicly disclosed nor known to be exploited at publication time, assessed exploitation as unlikely, and said fixes were made available through .NET Framework updates, while the ASP.NET issue CVE-2023-36899 was also listed in Microsoft's Security Update Guide as an elevation of privilege vulnerability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft updated its Security Update Guide entry for CVE-2026-35433 after the initial disclosure. The revised advisory remained consistent that the flaw could allow local privilege escalation to SYSTEM if a user triggered the payload in an application.
Microsoft disclosed CVE-2026-35433, a .NET Elevation of Privilege vulnerability caused by improper input validation and integer overflow or wraparound issues. Microsoft rated it Important with a CVSS 3.1 score of 7.3, said exploitation was not publicly known or observed, and made fixes available through .NET Framework updates.
Microsoft published a Security Update Guide entry for CVE-2023-36899, an ASP.NET Elevation of Privilege vulnerability. The advisory indicates the vulnerability was disclosed as part of Microsoft's August 2023 security updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **elevation of privilege** vulnerabilities affecting core enterprise technologies, including **Win32k** (`CVE-2023-36732`, `CVE-2023-24902`), **Windows IIS Server** (`CVE-2023-36434`), and **.NET** (`CVE-2026-26131`). The issues span both operating system and application server components, indicating potential paths for attackers to gain higher privileges after initial access on Windows-based environments. The advisories were released through Microsoft's Security Update Guide and portal, signaling that organizations running affected Windows desktops, servers, web infrastructure, or .NET workloads should review product exposure and apply the relevant security updates. For defenders, the concentration of privilege-escalation bugs across **Win32k**, **IIS**, and **.NET** underscores the need to prioritize patching on systems where local access, web server compromise, or application-layer abuse could be leveraged to obtain elevated permissions.
Jul 12, 2026
Microsoft published security advisories for two **Important** remote **denial-of-service (DoS)** vulnerabilities affecting **.NET** and **ASP.NET Core**: **CVE-2026-26127** and **CVE-2026-26130**. Both issues are scored **CVSS 3.1 7.5** with `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, indicating network-reachable exploitation with low complexity, no privileges, and no user interaction, resulting in high availability impact. CVE-2026-26127 is described as a **.NET DoS** condition associated with **CWE-125 (Out-of-bounds Read)**, while CVE-2026-26130 is an **ASP.NET Core DoS** issue associated with **CWE-770 (Allocation of Resources Without Limits or Throttling)**. Organizations running internet-exposed or high-availability services on these frameworks should prioritize applying Microsoft’s updates and review service-level protections (e.g., request throttling and resource limits) where applicable to reduce DoS risk.
Jun 29, 2026
Microsoft published security advisories for several **elevation-of-privilege** vulnerabilities affecting Windows components and related software, including **Microsoft PC Manager** (`CVE-2025-21322`), **Windows Installer** (`CVE-2025-21331`, `CVE-2025-21373`), **Visual Studio** (`CVE-2025-49739`), **.NET** (`CVE-2025-55247`), **Windows Health and Optimized Experiences** (`CVE-2025-59241`), and **Host Process for Windows Tasks** (`CVE-2025-60710`). Microsoft also lists an earlier **Windows Storage** privilege-escalation issue, `CVE-2023-36399`, in its security guidance portal. The advisories provide limited public detail beyond product names and vulnerability class, but the grouping indicates broad exposure across both endpoint and developer environments where successful exploitation could allow an attacker to gain higher privileges on a target system. Organizations using affected Microsoft software should review the corresponding Security Update Guide entries, prioritize patch validation for Windows and developer-tooling assets, and assess whether privilege-escalation paths could be chained with other flaws or post-compromise activity.
Jul 12, 2026