Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. The VSTest artifact postprocessor can consume a forged `executionComplete.json` from another local user and execute attacker-controlled output handling.

Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/517

CVSS Details - Version: 3.1 - Severity: High - Score: 7.5 (base score) - Vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C` - Weakness: CWE-284

Affected Platforms - Platforms: Windows, Linux, macOS - Architectures: All

Affected Packages The tables list affected versions of Microsoft.TestPlatform.CLI and their patched versions. The VSTest CLI is also bundled in the .NET SDK; SDK versions are listed separately below. Updating a separately installed CLI package does not…

Published by the source

11 Nov 2026, 00:39 UTC

Last modified by the source

11 Nov 2026, 01:00 UTC

Source last checked

11 Nov 2026, 07:35 UTC

1. Revision 1 · created · 11 Nov 2026

   Published from osv record GHSA-6856-87hx-p5x7

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-6856-87hx-p5x7

Advisory: Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability
IDs: GHSA-6856-87hx-p5x7
Record: https://patchnext.com/advisories/ghsa-6856-87hx-p5x7 (revision 1, source checked 11 Nov 2026, 07:35 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Partial vendor fix; fixed versions by package: microsoft.testplatform.cli 18.11.1, 18.10.2, 18.7.1, 18.0.2, 17.14.2, 17.12.1, 17.11.2, 17.8.1, 17.3.4. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet microsoft.testplatform.cli: affected >= 17.2.0-preview-20220301-01, < 17.3.4; >= 17.3.1, < 17.3.4; >= 17.3.2, < 17.3.4; >= 17.3.3, < 17.3.4; >= 17.8.0, < 17.8.1; >= 17.11.0, < 17.11.2; >= 17.11.1, < 17.11.2; >= 17.12.0, < 17.12.1; >= 17.14.0, < 17.14.2; >= 17.14.1, < 17.14.2; >= 18.0.0, < 18.0.2; >= 18.0.1, < 18.0.2; >= 18.7.0, < 18.7.1; >= 18.10.0, < 18.10.2; >= 18.10.1, < 18.10.2; >= 18.11.0, < 18.11.1; >= 17.4.0, <= 17.4.0; >= 17.4.1, <= 17.4.1; >= 17.5.0, <= 17.5.0; >= 17.6.0, <= 17.6.0; >= 17.6.1, <= 17.6.1; >= 17.6.2, <= 17.6.2; >= 17.6.3, <= 17.6.3; >= 17.7.0, <= 17.7.0; >= 17.7.1, <= 17.7.1; >= 17.7.2, <= 17.7.2; >= 17.9.0, <= 17.9.0; >= 17.10.0, <= 17.10.0; >= 17.13.0, <= 17.13.0; >= 18.3.0, <= 18.3.0; >= 18.4.0, <= 18.4.0; >= 18.5.0, <= 18.5.0; >= 18.5.1, <= 18.5.1; >= 18.6.0, <= 18.6.0; >= 18.8.0, <= 18.8.0; >= 18.8.1, <= 18.8.1; >= 18.9.0, <= 18.9.0; >= 17.4.0-preview-20220707-01, <= 17.4.0-preview-20220707-01; >= 17.4.0-preview-20220726-02, <= 17.4.0-preview-20220726-02; >= 17.4.0-preview-20221003-03, <= 17.4.0-preview-20221003-03; >= 17.4.0-release-20220926-01, <= 17.4.0-release-20220926-01; >= 17.5.0-preview-20221003-04, <= 17.5.0-preview-20221003-04; >= 17.5.0-preview-20221221-03, <= 17.5.0-preview-20221221-03; >= 17.6.0-preview-20230223-05, <= 17.6.0-preview-20230223-05; >= 17.7.0-preview-23364-03, <= 17.7.0-preview-23364-03; >= 17.7.0-preview.23280.1, <= 17.7.0-preview.23280.1; >= 17.8.0-preview-23371-04, <= 17.8.0-preview-23371-04; >= 17.8.0-preview-23424-02, <= 17.8.0-preview-23424-02; >= 17.8.0-release-23468-02, <= 17.8.0-release-23468-02; >= 17.9.0-preview-23503-02, <= 17.9.0-preview-23503-02; >= 17.9.0-preview-23531-01, <= 17.9.0-preview-23531-01; >= 17.9.0-preview-23577-04, <= 17.9.0-preview-23577-04; >= 17.9.0-release-23619-01, <= 17.9.0-release-23619-01; >= 17.10.0-preview-24080-01, <= 17.10.0-preview-24080-01; >= 17.10.0-release-24177-07, <= 17.10.0-release-24177-07; >= 17.11.0-release-24352-06, <= 17.11.0-release-24352-06; >= 17.11.0-release-24373-02, <= 17.11.0-release-24373-02; >= 17.14.0-preview-25107-01, <= 17.14.0-preview-25107-01; >= 17.3.0, < 17.3.4; fixed in 18.10.2, 18.7.1, 17.8.1, 17.3.4, 17.12.1, 17.14.2, 18.11.1, 17.11.2, 18.0.2

## Suggested inspection (read-only)
- NuGet microsoft.testplatform.cli: check the installed version with your package manager.

## Supported action
No complete vendor fix is recorded. Follow the primary source's mitigation guidance and check this record again before closing anything.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on microsoft.testplatform.cli.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GHSA-6856-87hx-p5x7 (OSV record GHSA-6856-87hx-p5x7 lists affected ranges: NuGet microsoft.testplatform.cli >=17.2.0-preview-20220301-01 =17.3.1 =17.3.2 =17.3.3 =17.8.0 =17.11.0 =17.11.1 =17.12.0 =17.14.0 =17.14.1 =18.0.0 =18.0.1 =18.7.0 =18.10.0 =18.10.1…)

Commands are suggestions: review each one before running it.