Microsoft .NET CVE-2026-58649

User interaction is required: the victim must visit an attacker-controlled web page or be induced to trigger a cross-origin HTTP request targeting the vulnerable .NET application. The attacker needs no credentials or privileges on the .NET server itself. The vulnerable .NET application must be network-reachable from the attacker's page (same LAN, internet-exposed, or same browser context). Exploitation is limited by: (1) UI:R - a victim must be socially engineered into visiting the attacker's page; (2) S:U - only data within the vulnerable .NET process scope is exposed, not adjacent systems; (3) the application must process or serve cross-origin requests in some form. Applications with no browser-facing HTTP endpoints (CLI tools, background services with no HTTP listener) are not directly exploitable via this vector.

The CVSS base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a realistic risk profile: network-reachable, no attacker privileges required, but contingent on victim user interaction. The C:H impact is notable - full confidentiality compromise of the vulnerable component's data - but scope is unchanged (S:U), limiting blast radius to the affected .NET process. EPSS data is not provided; with no KEV listing and no public POC, opportunistic widespread exploitation is unlikely at present. However, the broad deployment footprint of .NET across enterprise web services and the multi-version impact (four active runtime branches plus two Visual Studio releases) makes patching a meaningful priority. The UI:R dependency is the primary limiting factor lowering real-world risk below the C:H headline impact. No conflicting signals in the available data - attack vector and CWE are consistent.

An attacker hosts a malicious web page that makes a cross-origin XMLHttpRequest or Fetch API call to a vulnerable .NET web service on the victim's network or logged-in session. When the victim visits the page, the .NET runtime fails to reject the cross-origin request, returning sensitive application data (session tokens, user records, API responses) to the attacker-controlled JavaScript context. No public proof-of-concept has been identified at time of analysis, but the attack pattern is well-understood for CWE-346 vulnerabilities in web frameworks.