CVE-2026-65810: High Path Traversal in Microsoft .NET Framework

CVE-2026-65810 is a high severity (CVSS 7.8) relative path traversal flaw in Microsoft .NET Framework. The record says an unauthorized attacker could elevate privileges locally. Microsoft fixed it in the August 2026 updates, with a different KB for each Windows and .NET version, so install the one that matches each system.

What's affected

The record describes relative path traversal (CWE-23) in .NET Framework allowing local elevation of privilege, and lists .NET Framework on Windows 10 versions 1607 through 22H2 and Windows 11 23H2 through 25H2. Microsoft's update guide covers more, including Windows Server and Windows 11 26H1.

Microsoft scores it 7.8 with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That means local access, no privileges required and user interaction required. The score matches the record.

Microsoft lists fixes by .NET version and by Windows version. A few examples from the guide:

• .NET Framework 4.8 on Windows Server 2016 and Windows 10 1607: KB5120702, build 4.8.4805.0
• .NET Framework 3.5 and 4.8 on Windows Server 2022: KB5120705
• .NET Framework 3.5 and 4.8.1 on Windows 11 24H2: KB5120710
• .NET Framework 4.8.1 on Windows 11 26H1: KB5120711, build 4.8.9344.0
• .NET Framework 3.5 on Server 2012: KB5120716

The full list runs to dozens of entries. Use the update guide as the source.

How to check if you're exposed

Work out which .NET Framework versions each machine has, then confirm the matching KB. For a single machine, this lists installed updates:

Get-HotFix -Id KB5120702

Replace the KB number with the one Microsoft lists for your OS and framework version. Fixed KB numbers in the guide run from KB5120695 to KB5120747, so compare against Microsoft's table instead of guessing.

Remember that several framework versions can coexist on one Windows install. A machine on .NET 4.8 may also hold 3.5, and each has its own fix entry.

What to do now

1. Inventory .NET Framework versions on servers and workstations.
2. Install the August 2026 .NET Framework update, or a later cumulative update, for each version.
3. Restart where required and confirm the KB shows as installed.
4. Prioritise machines where untrusted users can run code or open files.
5. Keep your patch tool's compliance report as evidence.

Why it matters

Relative path traversal means a path like one with parent folder segments is built from outside input and resolves outside the intended folder. If the code then reads or writes a file at that place, an attacker can reach files the program did not mean to open. Microsoft's vector for this case needs a user to take some action.

The result is privilege elevation on the local machine. That is a common step after an attacker has run code with low rights, so patching it limits what a first foothold can become.

Microsoft marks it as not publicly disclosed and not exploited at release, with exploitation less likely. The record's KEV flag is false.

Quick check

Sources

• Microsoft Security Response Center update guide entry for CVE-2026-65810
• NVD record for CVE-2026-65810

Last reviewed: 18 October 2026.