Improper authorization in .NET allows an authorized attacker to elevate privileges locally.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dec081126f advisory.

    Update to .NET SDK 10.0.109 and Runtime 10.0.9

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.109.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.9.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0dce096c13 advisory.

    Update to .NET SDK 9.0.118 and Runtime 9.0.17

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.17/9.0.118.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.17/9.0.17.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-041785a779 advisory.

    Update to .NET SDK 8.0.128 and Runtime 8.0.28

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.28/8.0.128.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.28/8.0.28.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2f80369c73 advisory.

    Update to .NET SDK 8.0.128 and Runtime 8.0.28

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.28/8.0.128.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.28/8.0.28.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2954cd11bd advisory.

    Update to .NET SDK 9.0.118 and Runtime 9.0.17

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.17/9.0.118.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.17/9.0.17.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a424c1061e advisory.

    Update to .NET SDK 10.0.109 and Runtime 10.0.9

    Fixes: CVE-2026-45490,CVE-2026-45491,CVE-2026-45591

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.109.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.9/10.0.9.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16:

  - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose     sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user     accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with     Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and     serve sensitive data to unauthenticated users even after authentication is applied. (CVE-2026-13007)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows     an authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer     overflow on 32 bit platforms. A heap buffer overflow may lead to a crash or possibly an attacker     controlled code execution or other undefined behavior. (CVE-2026-31789)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1869 advisory.

    Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

    Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to     perform tampering locally. (CVE-2026-45491)

    Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a     network. (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1867 advisory.

    Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

    Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to     perform tampering locally. (CVE-2026-45491)

    Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a     network. (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1868 advisory.

    Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

    Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to     perform tampering locally. (CVE-2026-45491)

    Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a     network. (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the dotnet package has been released.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

  - Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to
    perform tampering locally. (CVE-2026-45491)

  - Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a
    network. (CVE-2026-45591)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

  - Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to     perform tampering locally. (CVE-2026-45491)

  - Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a     network. (CVE-2026-45591)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by the following vulnerabilities as referenced in the vendor advisory.

  - Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper authorization in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-45490)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
323283	Fedora 44 : dotnet10.0 (2026-dec081126f)	Nessus	Fedora Local Security Checks	medium
323282	Fedora 44 : dotnet9.0 (2026-0dce096c13)	Nessus	Fedora Local Security Checks	medium
323273	Fedora 44 : dotnet8.0 (2026-041785a779)	Nessus	Fedora Local Security Checks	medium
323271	Fedora 43 : dotnet8.0 (2026-2f80369c73)	Nessus	Fedora Local Security Checks	medium
323270	Fedora 43 : dotnet9.0 (2026-2954cd11bd)	Nessus	Fedora Local Security Checks	medium
323269	Fedora 43 : dotnet10.0 (2026-a424c1061e)	Nessus	Fedora Local Security Checks	medium
322483	Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)	Nessus	Misc.	high
322108	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-1869)	Nessus	Amazon Linux Local Security Checks	medium
322095	Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-1867)	Nessus	Amazon Linux Local Security Checks	medium
322050	Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-1868)	Nessus	Amazon Linux Local Security Checks	medium
321666	Photon OS 5.0: Dotnet PHSA-2026-5.0-0884	Nessus	PhotonOS Local Security Checks	medium
321548	Photon OS 4.0: Dotnet PHSA-2026-4.0-1036	Nessus	PhotonOS Local Security Checks	medium
443093	Alpine: multiple aspnetcore9-runtime packages, multiple dotnet-host packages: security update to 9.0.17-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
443093	Alpine: multiple aspnetcore9-runtime packages, multiple dotnet-host packages: security update to 9.0.17-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
443092	Alpine: multiple aspnetcore10-runtime packages, multiple dotnet-host packages: security update to 10.0.9-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
443092	Alpine: multiple aspnetcore10-runtime packages, multiple dotnet-host packages: security update to 10.0.9-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
320854	Security Update for Microsoft .NET Core (June 2026)	Nessus	Windows	medium
320853	Security Update for Microsoft .NET Core SDK (June 2026)	Nessus	Windows	high
320434	Linux Distros Unpatched Vulnerability : CVE-2026-45490	Nessus	Misc.	high

Detections

Analytics

CVE-2026-45490

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high