ReviewHigh

CVE-2026-62872

Microsoft Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

PRIORITY ASSESSMENT

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 8.8

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

Product: Microsoft Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2
Affected versions: >= 3.5.0 < 2.0.50727.9183 & 3.0.30729.9169, >= 3.0.0.0 < 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4144.0, >= 4.7.0 < 2.0.50727.9070 & 3.0.30729.9068 & 4.7.4144.0, >= 4.8.0 < 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4805.0, >= 4.8.1 < 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9343.0, >= 4.7.0 < 4.7.4144.0, >= 4.8.0 < 4.8.4805.0, >= 4.8.0.0 < 4.8.9344.0, 4.8.1, 4.8, 4.6.2, 4.7, 4.7.1, 4.7.2, 3.5
Fixed versions: No verified fixed-version field is available yet

Confirm exposure before applying a vendor-supported change.

1
Identify
Confirm that Microsoft Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5 AND 4.7.2 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.