Red Hat issued a security advisory (RHSA-2026:9077) for Red Hat Hardened Images RPMs, including dotnet10.0 packages, addressing several vulnerabilities such as CVE-2026-26131. This particular flaw involves incorrect default permissions in .NET components that permit local privilege escalation by authorized users. The advisory lists multiple RPM updates but does not confirm the availability of a patch or fix. Red Hat notes that mitigation options are either unavailable or insufficient according to their standards. The CVSS score for CVE-2026-26131 is 7.8 (high) as per Red Hat's assessment. Additional CVEs addressed include CVE-2026-26171, CVE-2026-32178, CVE-2026-32203, and CVE-2026-33116. No known exploits in the wild have been reported. The advisory references multiple CWE identifiers related to permission and memory issues.

The primary impact is local privilege escalation through incorrect default permissions in .NET components, allowing an authorized local attacker to gain higher system privileges. This can compromise confidentiality, integrity, and availability of affected systems. The vulnerabilities affect Red Hat Hardened Images RPMs, specifically dotnet10.0 packages on aarch64 and x86_64 architectures. No known active exploitation has been reported, but the high CVSS score indicates significant risk if exploited.

Currently, Red Hat does not provide an official patch or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users are advised to monitor Red Hat advisories for updates. Customers with Red Hat Technical Account Managers (TAM) can seek direct guidance. Until a fix is released, limiting local access to trusted users and applying general security best practices may reduce risk, but no specific mitigation is endorsed by Red Hat at this time.