A privilege escalation vulnerability in Microsoft .NET 10.0 allows local authenticated attackers to gain elevated permissions, posing a significant risk to host integrity.

This vulnerability is caused by incorrect default permissions (CWE-276) within the framework, which allows a local attacker with standard user privileges to escalate their access level.

The ability for a local user to escalate privileges represents a critical security failure, as it allows attackers to bypass intended security boundaries and potentially gain full control over the host system. With a CVSS score of 7.8, this vulnerability is classified as High severity and could lead to unauthorized data access, system-wide configuration changes, and the installation of persistent malicious software.

Immediate Action: Update all instances of Microsoft .NET to version 10.0.4 or later immediately to resolve the permission flaw.

Proactive Monitoring: Review system access logs for suspicious account activity or unauthorized attempts to perform administrative actions by standard users.

Compensating Controls: Ensure that the principle of least privilege is strictly enforced on all host systems to limit the impact of potential local privilege escalation.

Public Exploit Available: No

Given the potential for local privilege escalation, organizations should prioritize the deployment of the 10.0.4 update across all environments running .NET 10.0. Failure to patch allows any authenticated user on the system to potentially bypass security controls, which significantly increases the risk of lateral movement and full system compromise.