Security Resilience

CVE-2026-62872

Access Control in Microsoft .Net Framework 3.5 … 4.8.1

Access Control
Published
11 August 2026
Modified
14 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0078 56th percentile
Risk Priority 65 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-62872 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Microsoft .Net Framework. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.

CWE(s)
CWE-863

Related Threats

CVEs Like This One

CVE-2026-61925Same vendor: Microsoft
CVE-2026-70229Same vendor: Microsoft
CVE-2026-96918Same vendor: Microsoft
CVE-2026-83792Same vendor: Microsoft
CVE-2026-105733Same vendor: Microsoft
CVE-2023-28249Same vendor: Microsoft
CVE-2023-24932Same vendor: Microsoft
CVE-2023-24880Same vendor: Microsoft
CVE-2022-41091Same vendor: Microsoft
CVE-2023-28270Same vendor: Microsoft

Affected Assets

microsoft
.net framework
3.5, 4.6.2, 4.7, 4.7.1, 4.7.2

Mitigating Controls

Mitigating Controls (NIST 800-53 r5)

Our mappings, made for this CVE.

AC-3 Access Enforcement good match

AC-3 directly requires correct enforcement of authorization decisions on every access request, structurally preventing incorrect checks.

AC-24 Access Control Decisions good match

AC-24 ensures access-control decisions are made and applied consistently, reducing the chance of an incorrect authorization result.

AC-25 Reference Monitor good match

A reference monitor that is always invoked and tamper-proof forces every authorization decision through a verified, correct path.

AC-6 Least Privilege partial match

Least-privilege assignments shrink the set of authorizations that must be checked correctly, limiting exposure to flawed checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.3 Information access restriction full match
blocks

A.8.3's access restriction mechanisms, including granular per-user and per-identity controls, directly enforce correct authorization checks, preventing exploitation of incorrect authorization flaws.

A.5.15 Access control partial match
blocks

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-863, a class-level weakness, and none of its children carries one either.

References