What is the CVSS score of CVE-2026-50650?

CVE-2026-50650 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of .NET Framework are affected by CVE-2026-50650?

Microsoft .NET Framework and Visual Studio 2022/2026 contain a local privilege escalation vulnerability (CVE-2026-50650) that could allow attackers to execute code with full system access if a…. A patch is available.

How to fix or mitigate CVE-2026-50650?

Within 24 hours, identify all systems running Microsoft .NET Framework, .NET 8.0, .NET 9.0, Visual Studio 2022, or Visual Studio 2026 and alert development teams to the privilege escalation risk; restrict opening untrusted files from external sources until patches are deployed. Within 7 days, develop a phased patching schedule prioritizing development infrastructure and build systems, test patches in non-production environments to verify functionality, and begin staged deployment to developer workstations. Complete patching of all affected .NET Framework, .NET 8.0/9.0, and Visual Studio 2022/2026 instances within 30 days; document remediation completion and conduct a final audit to confirm no unpatched instances remain in your development environment.

.NET Framework CVE-2026-50650

EUVD-2026-44400 HIGH

Code Injection (CWE-94)

2026-07-14 microsoft

GHSA-2969-4q4w-w5h3

RCE Microsoft Code Injection Red Hat Suse Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local vector and required user interaction (open malicious content) give AV:L/UI:R with PR:N since no prior auth is needed; code injection yields full C/I/A within unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:42 vuln.today

CVE Published

Jul 14, 2026 - 19:29 nvd

HIGH 7.8

DescriptionCVE.org

Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.

AnalysisAI

Local privilege elevation in Microsoft .NET Framework (and .NET 8.0/9.0 plus Visual Studio 2022/2026) via code injection (CWE-94) that lets an unauthorized attacker run code with full confidentiality, integrity, and availability impact after a victim is tricked into interacting with attacker-supplied content. Microsoft reported the issue and has shipped a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation requires local access and user interaction (UI:R), which meaningfully limits mass-exploitation despite the high 7.8 CVSS score.

Technical ContextAI

.NET Framework and modern .NET (Core) are Microsoft's managed-code runtimes and class libraries used to build and execute Windows applications; Visual Studio embeds these SDKs/runtimes for developer builds. The root cause is CWE-94, improper control of generation of code ('code injection'), meaning the runtime or a component processes attacker-influenced input in a way that causes it to generate or execute unintended code paths rather than treating the input purely as data. The CPE set is unusually broad - cpe:2.3:a:microsoft:.net_8.0, .net_9.0, and the full Microsoft .NET Framework 3.5 through 4.8.1 family (including the 4.6.2/4.7/4.7.1/4.7.2 servicing bundle), plus Visual Studio 2022 17.12 and 17.14 (and 2026 18.7 per tags) - which indicates the flaw sits in a shared runtime/library surface serviced across every currently supported .NET line and the Visual Studio toolchain rather than in one application.

RemediationAI

Patch available per vendor advisory: apply Microsoft's updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50650, which covers .NET 8.0/9.0, the .NET Framework 3.5-4.8.1 servicing branches, and the affected Visual Studio 2022 (17.12, 17.14) and 2026 (18.7) toolchains; the provided data confirms a fix is available but does not enumerate exact fixed build/KB numbers, so pull the precise versions from the MSRC update guide and deploy through Windows Update/WSUS and the Visual Studio installer. Because .NET Framework updates are delivered as cumulative OS-level packages, ensure the correct update ring for each Framework version installed on a host is applied rather than assuming a single patch covers all branches. As compensating controls until patched, prioritize developer and build machines (Visual Studio hosts), avoid opening untrusted projects, solutions, or files that drive the runtime/toolchain, and enforce least-privilege on local accounts so a successful code-injection has reduced blast radius; note these are only partial mitigations since the flaw executes in the interacting user's context, so patching remains the durable fix.