SB20261110352 - Improper access control in Visual Studio
Published: November 10, 2026
Security Bulletin ID
SB20261110352
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper access control (CVE-ID: CVE-2026-105544)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges locally and gain the rights of the user running the affected application.
The vulnerability exists due to improper access control in .NET when an affected application is running. A local user can exploit a race condition, with user interaction, to gain the rights of the user running the affected application.
Remediation
Install update from vendor's website.