Microsoft Discloses .NET and ASP.NET Elevation of Privilege Flaws

Microsoft published security advisories for elevation of privilege vulnerabilities affecting ASP.NET and .NET, including CVE-2023-36899 and CVE-2026-35433. The newer flaw, CVE-2026-35433, affects .NET and stems from improper input validation combined with an integer overflow or wraparound condition that can let an unauthorized attacker elevate privileges locally if a user triggers the malicious payload in an application.

Microsoft rated CVE-2026-35433 as Important with a CVSS 3.1 score of 7.3 and said successful exploitation could result in SYSTEM privileges. The company reported that the issue was neither publicly disclosed nor known to be exploited at publication time, assessed exploitation as unlikely, and said fixes were made available through .NET Framework updates, while the ASP.NET issue CVE-2023-36899 was also listed in Microsoft's Security Update Guide as an elevation of privilege vulnerability.