What is the CVSS score of CVE-2026-50646?

CVE-2026-50646 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

How to fix or mitigate CVE-2026-50646?

Within 24 hours, inventory all systems running affected Microsoft .NET Framework versions (3.5-4.8.1, 8.0, 9.0) and Visual Studio editions (2022, 2026), prioritizing development workstations and servers hosting .NET applications. Within 7 days, deploy the vendor-released patch to critical-tier systems (development, production) and begin staged rollout to other environments using Windows Update or Microsoft's security guidance. Within 30 days, complete patching across all inventory, including legacy and non-production systems, and validate the update through targeted testing of .NET applications in each environment.

.NET Framework CVE-2026-50646

Q: Which versions of .NET Framework are affected by CVE-2026-50646?

Microsoft .NET Framework and Visual Studio versions 3.5-4.8.1, 8.0, 9.0, and 2022-2026 contain a local code execution vulnerability triggered when users open malicious files, with no public exploit…. A patch is available.

EUVD-2026-44397 HIGH

Protection Mechanism Failure (CWE-693)

2026-07-14 microsoft

GHSA-gh2h-rhph-h37g

Authentication Bypass Microsoft Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.8

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious .NET file or project
Delivery

Deliver to victim via email or repo
Exploit

Victim opens content in vulnerable runtime
Execution

Protection mechanism bypassed
Impact

Execute arbitrary code in user context

Vulnerability Assessment

Weakness	CWE CWE-693 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V15 - Secure Coding and Architecture Protection mechanism completeness
Exploitation Conditions	Exploitation requires local delivery of attacker-controlled content and the victim performing an action to open or process it (CVSS UI:R), so this is not remotely triggerable without interaction; the target host must have one of the affected .NET Framework versions (3.5-4.8.1), the .NET 8.0/9.0 runtime, or Visual Studio 2022 (17.12/17.14) / 2026 (18.7) installed. No prior authentication or privileges are needed on the application (PR:N), and complexity is low (AC:L), but the mandatory user interaction and local attack vector are the key limiting factors that reduce realistic risk below a remote-unauthenticated flaw. The provided description does not name the exact feature or file type that triggers the protection mechanism failure, so the precise malicious-content format should be confirmed from the Microsoft advisory.
Impact	The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) describes a locally-delivered, low-complexity attack that needs no privileges but does need the victim to take an action, capping it below network-wormable criticality. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so all available exploitation signals point to no confirmed real-world exploitation yet - this is a patch-on-cycle rather than emergency-out-of-band situation on the exploitation evidence alone. However, the extraordinary deployment footprint of .NET on Windows and the 'Authentication Bypass' tag raise the practical stakes: a reliable weaponization would have a very large target population. One tension to verify: the description says 'unauthorized attacker' and the vector uses PR:N (unauthenticated), yet the attack is local and interaction-dependent, so 'unauthorized' here means the attacker holds no application privileges rather than that exploitation is remote - treat it as a user-interaction-gated local vector, not a remote unauthenticated one.
Exploit ScenarioDerived	An attacker crafts a malicious file, solution, or project that abuses the failed .NET protection mechanism and delivers it to a victim by email, chat, or a shared repository. When the user opens the content on a machine with a vulnerable .NET runtime or Visual Studio build (AV:L, UI:R), the bypass triggers and arbitrary code runs in the victim's security context. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS vector rather than an observed sample.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 1.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Local code execution in Microsoft .NET (Framework 3.5 through 4.8.1, .NET 8.0/9.0, and Visual Studio 2022/2026) arises from a protection mechanism failure (CWE-693) that lets an unauthorized attacker run arbitrary code once a victim is lured into opening a malicious file or project. The flaw requires user interaction (UI:R) and local delivery (AV:L) but no prior privileges (PR:N), yielding high confidentiality, integrity, and availability impact and a 7.8 CVSS score. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the ubiquity of .NET on Windows makes patching a priority.

RemediationAI

Apply the vendor patch: Patch available per vendor advisory (Microsoft) - install the security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646 for each affected component, which for the in-box .NET Framework arrive via the monthly Windows cumulative/security-only updates and for .NET 8.0/9.0 via the corresponding runtime servicing release, while Visual Studio 2022 (17.12/17.14) and 2026 (18.7) are fixed through their in-product updater. Prioritize developer workstations and build agents given the Visual Studio exposure. Because exploitation depends on a user opening malicious content, sound interim compensating controls are to restrict opening untrusted files/projects and enforce Mark-of-the-Web/Protected View and SmartScreen (trade-off: does not close the underlying flaw and can be bypassed by social engineering), remove or update end-of-support .NET Framework versions that no longer receive fixes, and apply application allowlisting to limit which binaries can execute (trade-off: administrative overhead and potential to block legitimate developer tooling). Exact fixed version numbers are not present in the provided data and should be taken directly from the MSRC advisory rather than assumed.

Affected VersionsENISA

Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 <2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0

Microsoft .NET Framework 3.5 3.5.0 <2.0.50727.8983 & 3.0.30729.8978

Microsoft .NET Framework 3.5 AND 4.8 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

.NET 8.0 8.0.0 <8.0.29

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 <4.7.4143.0

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.36

Microsoft .NET Framework 4.8 4.8.0 <4.8.4803.0

.NET 9.0 9.0.0 <9.0.18

Microsoft Visual Studio 2026 version 18.7 18.0 <18.7.4

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.22

Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Affected Packages

nuget microsoft.windowsdesktop.app.runtime.win-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.windowsdesktop.app.runtime.win-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.windowsdesktop.app.runtime.win-x86 fix: 8.0.29, 9.0.18, 10.0.10

euvd microsoft_net_framework_3_5_3_5_0_2_0_50727_8983 no fix

euvd microsoft_net_framework_3_5_and_4_7_2_4_7_0_2_0_50727_8983_3_0_30729_8978 no fix

euvd microsoft_net_framework_3_5_and_4_8_1_4_8_1_2_0_50727_9182_3_0_30729_9168 no fix

euvd microsoft_net_framework_3_5_and_4_8_4_8_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_4_6_2_4_7_4_7_1_4_7_2 fix: 4.7.4143.0

euvd microsoft_net_framework_4_8 fix: 4.8.4803.0

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.22

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.36

euvd microsoft_visual_studio_2026_version_18_7 fix: 18.7.4

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 14 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected component is Microsoft's .NET runtime and framework stack, spanning the legacy .NET Framework (3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8, 4.8.1) shipped with Windows and the modern cross-platform .NET 8.0/9.0 runtimes, plus the Visual Studio 2022 (17.12/17.14) and 2026 (18.7) tooling that bundles them, per the supplied CPE list. CWE-693 (Protection Mechanism Failure) indicates that a security control the runtime relies on - such as a sandbox, trust boundary, or bypassable authentication/validation check (the intel tags this as an Authentication Bypass class) - does not function as intended, allowing untrusted input to reach a code path that executes with the user's privileges. Because the same defect spans both the in-box Windows .NET Framework and the redistributable .NET 8/9 runtimes, the exposed surface includes desktop applications, developer machines, and build environments.

Know when Microsoft Net Framework 3 5 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

vuln.today AI 7.8 HIGH

Local file/project delivery gives AV:L with UI:R for the victim opening it; no app privileges needed (PR:N); code execution in user context yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.8 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

Executive ViewAI

Why It Matters

Microsoft .NET Framework and Visual Studio versions 3.5-4.8.1, 8.0, 9.0, and 2022-2026 contain a local code execution vulnerability triggered when users open malicious files, with no public exploit identified at the time of analysis but significant risk given .NET's enterprise ubiquity. The flaw bypasses security protections without requiring elevated privileges and compromises system confidentiality, integrity, and availability. Organizations have a limited window before public weaponization to patch millions of Windows developer workstations and application servers.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

1.6%

Top 27% exploitable

Prevalence

Ubiquitous

.NET Framework ships in-box on virtually all Windows systems

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

9 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 1.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.