CVE-2023-36049

What it actually does

The vulnerability permits remote unauthenticated attackers to elevate privileges in affected .NET, .NET Framework, and Visual Studio components, resulting in full read, write, and execute capabilities on the target system.

Why it matters to the business

Organizations relying on dotnet/core or related Microsoft developer tools risk complete system takeover by remote attackers, potentially leading to data breaches, ransomware deployment, and operational downtime; the high CVSS and stable EPSS indicate ongoing exposure risk 1057 days after publication despite absence from KEV.

How an attack unfolds

An attacker identifies an exposed .NET service or Visual Studio instance, crafts a malicious network request that abuses the privilege escalation flaw, and achieves elevated access to execute arbitrary code or access restricted resources without credentials or user interaction.

How to fix it

Upgrade dotnet/core (GIT) to the fixed commit d78b3180414d35d6c7d136db753474e2ae2b33df; apply the corresponding Microsoft security updates for .NET, .NET Framework, and Visual Studio across all affected installations.

How to confirm the fix worked

Confirm the deployed dotnet/core commit hash matches d78b3180414d35d6c7d136db753474e2ae2b33df, re-scan affected products with updated vulnerability assessment tools, and validate that privilege boundaries are enforced in test environments.

Typical attack path

1. Scan for publicly reachable .NET or Visual Studio endpoints
2. Send crafted unauthenticated network requests to trigger the flaw
3. Escalate privileges to gain administrative or system-level access
4. Deploy payloads for persistence, data exfiltration, or further lateral movement

How to detect it

Review system and application logs for unexpected privilege changes or unauthorized code execution originating from .NET processes after November 2023; correlate with network traffic showing unauthenticated requests to vulnerable endpoints and monitor for new high-privilege processes.

What your security team should do

• Prioritize patching all instances to the fixed commit due to critical severity and remote exploitability
• Reduce network exposure of .NET services until updates are applied
• Enable enhanced logging on .NET runtime and Visual Studio processes for anomaly detection
• Review downstream dependents for inherited risk given ecosystem prevalence