Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.

rocky_linux RLSA-2026:25110: RLSA-2026:25110: .NET 8.0 security update (Important)

rocky_linux RLSA-2026:25114: RLSA-2026:25114: .NET 10.0 security update (Important)

rocky_linux RLSA-2026:25113: RLSA-2026:25113: .NET 9.0 security update (Important)

oracle_linux ELSA-2026-25114: ELSA-2026-25114:  .NET 10.0 security update (IMPORTANT)

microsoft_dotnet 2026_Jun_09: dotnet

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25114 advisory.

    [10.0.109-1.0.1]
    - Add support for Oracle Linux

    [10.0.109-1]
    - Update to .NET SDK 10.0.109 and Runtime 10.0.9
    - Resolves: RHEL-181555

    [10.0.106-2]
    - Update to .NET SDK 10.0.106 and Runtime 10.0.6
    - Resolves: RHEL-163381

    [10.0.104-2]
    - Update to .NET SDK 10.0.104 and Runtime 10.0.4
    - Resolves: RHEL-152949

    [10.0.103-2]
    - Update to .NET SDK 10.0.103 and Runtime 10.0.3
    - Resolves: RHEL-144973

    [10.0.102-2]
    - Update to .NET SDK 10.0.102 and Runtime 10.0.2
    - Resolves: RHEL-138639

    [10.0.101-2]
    - Update to .NET SDK 10.0.101 and Runtime 10.0.1
    - Resolves: RHEL-130937

    [10.0.100-1]
    - Update to .NET SDK 10.0.100 and Runtime 10.0.0
    - Resolves: RHEL-125747

    [10.0.100~rc.2.25502.107-0.10]
    - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107
    - Resolves: RHEL-121301

    [10.0.100~preview.6.25358.103-0.9]
    - Disable bootstrap
    - Resolves: RHEL-114568

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25113 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25114 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25110 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25110 advisory.

    [8.0.128-1.0.1]
    - Add support for Oracle Linux

    [8.0.128-1]
    - Update to .NET SDK 8.0.128 and Runtime 8.0.28
    - Resolves: RHEL-181052

    [8.0.126-2]
    - Update to .NET SDK 8.0.126 and Runtime 8.0.26
    - Resolves: RHEL-163413

    [8.0.125-2]
    - Update to .NET SDK 8.0.125 and Runtime 8.0.25
    - Resolves: RHEL-152929

    [8.0.124-2]
    - Update to .NET SDK 8.0.124 and Runtime 8.0.24
    - Resolves: RHEL-144965

    [8.0.123-2]
    - Update to .NET SDK 8.0.123 and Runtime 8.0.23
    - Resolves: RHEL-138651

    [8.0.122-2]
    - Update to .NET SDK 8.0.122 and Runtime 8.0.22
    - Resolves: RHEL-125737

    [8.0.121-2]
    - Update to .NET SDK 8.0.121 and Runtime 8.0.21
    - Resolves: RHEL-116865

    [8.0.120-2]
    - Update to .NET SDK 8.0.120 and Runtime 8.0.20
    - Resolves: RHEL-112254

    [8.0.119-2]
    - Update to .NET SDK 8.0.119 and Runtime 8.0.19
    - Resolves: RHEL-106722

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-25113 advisory.

    [9.0.118-1.0.1]
    - Add support for Oracle Linux

    [9.0.118-1]
    - Update to .NET SDK 9.0.118 and Runtime 9.0.17
    - Resolves: RHEL-181550

    [9.0.116-2]
    - Update to .NET SDK 9.0.116 and Runtime 9.0.15
    - Resolves: RHEL-163389

    [9.0.115-2]
    - Update to .NET SDK 9.0.115 and Runtime 9.0.14
    - Resolves: RHEL-152941

    [9.0.114-2]
    - Update to .NET SDK 9.0.114 and Runtime 9.0.13
    - Resolves: RHEL-144969

    [9.0.113-2]
    - Update to .NET SDK 9.0.113 and Runtime 9.0.12
    - Resolves: RHEL-138644

    [9.0.112-2]
    - Update to .NET SDK 9.0.112 and Runtime 9.0.11
    - Resolves: RHEL-125742

    [9.0.111-2]
    - Update to .NET SDK 9.0.111 and Runtime 9.0.10
    - Resolves: RHEL-116856

    [9.0.110-2]
    - Update to .NET SDK 9.0.110 and Runtime 9.0.9
    - Resolves: RHEL-112264

    [9.0.109-2]
    - Update to .NET SDK 9.0.109 and Runtime 9.0.8
    - Resolves: RHEL-106726

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25221 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25111 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25115 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:25112 advisory.

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)
      * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25222 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25220 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25115 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25114 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25110 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25113 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25112 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25111 advisory.

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new     APIs, and it includes a CLR implementation.

    New versions of .NET that address a security vulnerability are now available. The updated versions are     .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

    * dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

    * dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to     perform tampering locally. (CVE-2026-45491)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
320689	Oracle Linux 8 : .NET / 10.0 (ELSA-2026-25114)	Nessus	Oracle Linux Local Security Checks	medium
320646	AlmaLinux 8 : .NET 9.0 (ALSA-2026:25113)	Nessus	Alma Linux Local Security Checks	medium
320644	AlmaLinux 8 : .NET 10.0 (ALSA-2026:25114)	Nessus	Alma Linux Local Security Checks	medium
320641	AlmaLinux 8 : .NET 8.0 (ALSA-2026:25110)	Nessus	Alma Linux Local Security Checks	medium
320639	Oracle Linux 8 : .NET / 8.0 (ELSA-2026-25110)	Nessus	Oracle Linux Local Security Checks	medium
320638	Oracle Linux 8 : .NET / 9.0 (ELSA-2026-25113)	Nessus	Oracle Linux Local Security Checks	medium
320633	RHEL 9 : .NET 9.0 (RHSA-2026:25221)	Nessus	Red Hat Local Security Checks	medium
320620	AlmaLinux 10 : .NET 8.0 (ALSA-2026:25111)	Nessus	Alma Linux Local Security Checks	medium
320619	AlmaLinux 10 : .NET 10.0 (ALSA-2026:25115)	Nessus	Alma Linux Local Security Checks	medium
320618	AlmaLinux 10 : .NET 9.0 (ALSA-2026:25112)	Nessus	Alma Linux Local Security Checks	medium
320559	RHEL 9 : .NET 10.0 (RHSA-2026:25222)	Nessus	Red Hat Local Security Checks	medium
320557	RHEL 9 : .NET 8.0 (RHSA-2026:25220)	Nessus	Red Hat Local Security Checks	medium
320525	RHEL 10 : .NET 10.0 (RHSA-2026:25115)	Nessus	Red Hat Local Security Checks	medium
320513	RHEL 8 : .NET 10.0 (RHSA-2026:25114)	Nessus	Red Hat Local Security Checks	medium
320511	RHEL 8 : .NET 8.0 (RHSA-2026:25110)	Nessus	Red Hat Local Security Checks	medium
320510	RHEL 8 : .NET 9.0 (RHSA-2026:25113)	Nessus	Red Hat Local Security Checks	medium
320508	RHEL 10 : .NET 9.0 (RHSA-2026:25112)	Nessus	Red Hat Local Security Checks	medium
320507	RHEL 10 : .NET 8.0 (RHSA-2026:25111)	Nessus	Red Hat Local Security Checks	medium
320433	Linux Distros Unpatched Vulnerability : CVE-2026-45491	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-45491

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium