Path traversal in Microsoft products - CVE-2026-70161
Published: October 14, 2026
Vulnerability identifier: #VU154606
CSH Severity: Medium
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-70161
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to path traversal in .NET when handling pathnames. A local user can exploit the path traversal locally to escalate privileges.
User interaction is required for exploitation.
Affected software
.NET
Visual Studio
Microsoft .NET Framework
Visual Studio
Microsoft .NET Framework
How to mitigate CVE-2026-70161
Install security update from vendor's website.
.NET - update to 9.0.319, 9.0.122
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.402
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.402