What is the CVSS score of CVE-2026-62909?

CVE-2026-62909 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Microsoft .NET are affected by CVE-2026-62909?

Microsoft .NET and Visual Studio used by development teams face a local privilege escalation vulnerability that could allow attackers with system access to take over affected machines completely.. A patch is available.

Is there a public PoC exploit available for CVE-2026-62909?

Yes, a public proof-of-concept exploit is available for CVE-2026-62909. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-62909?

Within 24 hours, conduct an asset inventory to identify all systems running .NET 8.0, 9.0, or 10.0, and Visual Studio 2022 or 2026 installations, prioritizing systems with elevated data sensitivity or network access. Within 7 days, deploy patched versions of .NET and Visual Studio to development and testing environments, validate functionality, and begin staged rollout to production systems starting with non-critical infrastructure. Within 30 days, complete patch deployment across all affected systems organization-wide, perform verification scans to confirm no unpatched instances remain, and document completion for compliance records.

Microsoft .NET CVE-2026-62909

EUVD-2026-56412 HIGH

Uncaught Exception (CWE-248)

2026-08-11 secure@microsoft.com

GHSA-9mr8-pwpw-3j2w

Information Disclosure Microsoft Red Hat Visual Studio 2022 Suse Net Visual Studio 2026

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local-only vector confirmed by description; AC:H reflects specific exception-triggering conditions; PR:L because an authenticated local account is required; S:C because privilege escalation crosses the .NET runtime security boundary to host OS.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:57 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.8

DescriptionCVE.org

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows a low-privileged local attacker to elevate privileges by triggering an uncaught exception (CWE-248) within the runtime. The CVSS scope change (S:C) indicates impact extends beyond the .NET security boundary to the underlying host system. No public exploit identified at time of analysis, and Microsoft has released patched versions across all affected branches.

Technical ContextAI

CWE-248 (Uncaught Exception) describes a failure to handle exceptional conditions, leaving the application in an undefined or exploitable state. In .NET's managed runtime, unhandled exceptions can disrupt security-relevant control flows - such as permission checks or sandbox enforcement - allowing execution to proceed through unintended code paths. The scope change (S:C) in the CVSS vector indicates the vulnerable component (.NET runtime or a framework library) operates within a restricted security context, and exploitation breaches that boundary to affect the broader OS security domain. Affected CPE-derivable products span three active .NET LTS/STS branches (8.0, 9.0, 10.0) and two Visual Studio major versions (2022 17.14.x and 2026 18.8.x), indicating the flaw resides in a shared runtime or SDK component common to all of these.

RemediationAI

Vendor-released patches are available for all affected branches. Update .NET 8.0 to version 8.0.30 or later, .NET 9.0 to version 9.0.19 or later, and .NET 10.0 to version 10.0.11 or later via the standard .NET update channel or NuGet. For Visual Studio installations, update Visual Studio 2022 to version 17.14.38 or later and Visual Studio 2026 to version 18.8.3 or later through Visual Studio's built-in updater or the Microsoft Update Catalog. Full advisory and download links are at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62909. Where immediate patching is not feasible, restrict local interactive and RDP logon rights to trusted administrative accounts only, as PR:L and AV:L require a local authenticated session - this reduces the pool of potential attackers but does not eliminate the vulnerability.