What is the CVSS score of CVE-2026-50650?

CVE-2026-50650 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-50650?

Within 24 hours, identify all systems running Microsoft .NET Framework, .NET 8.0, .NET 9.0, Visual Studio 2022, or Visual Studio 2026 and alert development teams to the privilege escalation risk; restrict opening untrusted files from external sources until patches are deployed. Within 7 days, develop a phased patching schedule prioritizing development infrastructure and build systems, test patches in non-production environments to verify functionality, and begin staged deployment to developer workstations. Complete patching of all affected .NET Framework, .NET 8.0/9.0, and Visual Studio 2022/2026 instances within 30 days; document remediation completion and conduct a final audit to confirm no unpatched instances remain in your development environment.

.NET Framework CVE-2026-50650

Q: Which versions of .NET Framework are affected by CVE-2026-50650?

Microsoft .NET Framework and Visual Studio 2022/2026 contain a local privilege escalation vulnerability (CVE-2026-50650) that could allow attackers to execute code with full system access if a…. A patch is available.

EUVD-2026-44400 HIGH

Code Injection (CWE-94)

2026-07-14 microsoft

GHSA-2969-4q4w-w5h3

RCE Microsoft Code Injection Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.8

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local access to target host
Delivery

Deliver crafted file/project to user
Exploit

User opens malicious content (UI:R)
Execution

.NET runtime injects/generates attacker code
Persist

Execute code in victim context
Impact

Elevate privileges / full C-I-A impact

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires local access to the target host and user interaction (CVSS AV:L, UI:R): a victim must open or process attacker-supplied content - a crafted file, project, or solution handled by the vulnerable .NET runtime or Visual Studio toolchain - for the code-injection to trigger. No prior authentication or privileges are needed (PR:N), and attack complexity is low (AC:L), but the mandatory user-interaction and local-access requirements are the key limiting factors, meaning there is no remote or automated/unattended exploitation path. The provided data does not name a specific enabled feature or non-default setting as a precondition, so the practical gate is simply that a user on the machine is convinced to interact with malicious content in a vulnerable .NET/Visual Studio version; the description's framing as local privilege elevation versus the RCE tags should be confirmed against Microsoft's advisory.
Impact	The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 High) describes a locally-reachable, low-complexity flaw that needs no prior privileges but does require victim interaction, yielding full C/I/A impact within an unchanged scope. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation-probability signals are absent - treat exploitation likelihood as unquantified rather than low. There is a notable internal tension: NVD's description characterizes the outcome as local privilege elevation, while the tags (RCE, Code Injection) and the C:H/I:H/A:H impact read more like arbitrary code execution in the victim's security context - verify the precise impact class with Microsoft's advisory. Because the attacker requires local presence and user interaction, this is a real 'patch on schedule' priority (especially on developer/build hosts given the Visual Studio CPEs) but not a drop-everything internet-facing emergency; the absence of any public exploit or KEV entry supports normal Patch-Tuesday prioritization.
Exploit ScenarioDerived	An attacker delivers a crafted file, project, or solution to a developer or user and induces them to open or process it (UI:R) on a system with a vulnerable .NET runtime or Visual Studio build. When the runtime/toolchain processes the malicious content it generates and executes attacker-controlled code (CWE-94), giving the attacker code execution and full impact in the victim's context. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector and tags rather than a demonstrated POC.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Local privilege elevation in Microsoft .NET Framework (and .NET 8.0/9.0 plus Visual Studio 2022/2026) via code injection (CWE-94) that lets an unauthorized attacker run code with full confidentiality, integrity, and availability impact after a victim is tricked into interacting with attacker-supplied content. Microsoft reported the issue and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation requires local access and user interaction (UI:R), which meaningfully limits mass-exploitation despite the high 7.8 CVSS score.

RemediationAI

Patch available per vendor advisory: apply Microsoft's updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650, which covers .NET 8.0/9.0, the .NET Framework 3.5-4.8.1 servicing branches, and the affected Visual Studio 2022 (17.12, 17.14) and 2026 (18.7) toolchains; the provided data confirms a fix is available but does not enumerate exact fixed build/KB numbers, so pull the precise versions from the MSRC update guide and deploy through Windows Update/WSUS and the Visual Studio installer. Because .NET Framework updates are delivered as cumulative OS-level packages, ensure the correct update ring for each Framework version installed on a host is applied rather than assuming a single patch covers all branches. As compensating controls until patched, prioritize developer and build machines (Visual Studio hosts), avoid opening untrusted projects, solutions, or files that drive the runtime/toolchain, and enforce least-privilege on local accounts so a successful code-injection has reduced blast radius; note these are only partial mitigations since the flaw executes in the interacting user's context, so patching remains the durable fix.

Affected VersionsENISA

Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

Microsoft .NET Framework 3.5 AND 4.8 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

.NET 8.0 8.0.0 <8.0.29

Microsoft .NET Framework 3.5 3.5.0 <2.0.50727.8983 & 3.0.30729.8978

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.36

.NET 9.0 9.0.0 <9.0.18

Microsoft .NET Framework 4.8 4.8.0 <4.8.4803.0

Microsoft Visual Studio 2026 version 18.7 18.0 <18.7.4

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 <4.7.4143.0

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.22

Affected Packages

nuget microsoft.windowsdesktop.app.runtime.win-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.windowsdesktop.app.runtime.win-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.windowsdesktop.app.runtime.win-x86 fix: 8.0.29, 9.0.18, 10.0.10

euvd microsoft_net_framework_3_5_3_5_0_2_0_50727_8983 no fix

euvd microsoft_net_framework_3_5_and_4_7_2_4_7_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_3_5_and_4_8_1_4_8_1_2_0_50727_9182_3_0_30729_9168 no fix

euvd microsoft_net_framework_3_5_and_4_8_4_8_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_4_6_2_4_7_4_7_1_4_7_2 fix: 4.7.4143.0

euvd microsoft_net_framework_4_8 fix: 4.8.4803.0

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.22

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.36

euvd microsoft_visual_studio_2026_version_18_7 fix: 18.7.4

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 14 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

.NET Framework and modern .NET (Core) are Microsoft's managed-code runtimes and class libraries used to build and execute Windows applications; Visual Studio embeds these SDKs/runtimes for developer builds. The root cause is CWE-94, improper control of generation of code ('code injection'), meaning the runtime or a component processes attacker-influenced input in a way that causes it to generate or execute unintended code paths rather than treating the input purely as data. The CPE set is unusually broad - cpe:2.3:a:microsoft:.net_8.0, .net_9.0, and the full Microsoft .NET Framework 3.5 through 4.8.1 family (including the 4.6.2/4.7/4.7.1/4.7.2 servicing bundle), plus Visual Studio 2022 17.12 and 17.14 (and 2026 18.7 per tags) - which indicates the flaw sits in a shared runtime/library surface serviced across every currently supported .NET line and the Visual Studio toolchain rather than in one application.

Know when Microsoft Net Framework 3 5 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD HIGH

vuln.today AI 7.8 HIGH

Local vector and required user interaction (open malicious content) give AV:L/UI:R with PR:N since no prior auth is needed; code injection yields full C/I/A within unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.8 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

Executive ViewAI

Why It Matters

Microsoft .NET Framework and Visual Studio 2022/2026 contain a local privilege escalation vulnerability (CVE-2026-50650) that could allow attackers to execute code with full system access if a developer is tricked into opening malicious content. While no public exploit has been identified, the threat directly targets your development workforce and could enable supply chain attacks through code tampering. Immediate patching is required to protect build environments and intellectual property.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 80% exploitable

Prevalence

Ubiquitous

.NET Framework/runtime ships with and underpins most Windows environments

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

9 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +39

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.