Microsoft Visual Studio CVE-2026-69805

Requires that a Visual Studio 2022 (17.14.0 to <17.14.40), Visual Studio 2026 (18.9.0 to <18.9.3), or Microsoft.Diagnostics.Runtime (ClrMD) component process an externally-supplied file name or path that the attacker can influence over the network; the higher-privileged process must then resolve that path (CWE-73, no canonicalization). Limiting factors: the CVSS AC:H rating indicates exploitation is not straightforward and depends on specific input conditions or timing outside the attacker's control, and the affected components are developer/diagnostics tooling rather than always-on network services, so realistic exposure depends on whether the vulnerable component consumes untrusted input in a given deployment. No authentication is required (PR:N) and no user interaction (UI:N).

This is a genuinely high-severity but not high-urgency issue. The vendor CVSS of 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, unauthenticated elevation-of-privilege flaw with total impact (C:H/I:H/A:H), but the AC:H metric signals that reliable exploitation requires specific conditions or timing the attacker does not fully control. The corroborating signals all point AWAY from imminent mass exploitation: EPSS is only 0.51% (42nd percentile), CISA SSVC records Exploitation as 'none' and Automatable as 'no' (while confirming Technical Impact as 'total', consistent with the CVSS impact metrics), and there is no CISA KEV listing and no public POC. Exploitation status: no public exploit identified at time of analysis. The one tension worth flagging: the description phrases this as 'elevate privileges over a network' via CWE-73 (external control of file name/path), which is a somewhat unusual pairing - path-injection EoP typically implies the attacker can influence a path that a higher-privileged .NET process consumes, so the realistic vector likely involves a developer/diagnostics workflow rather than a directly internet-exposed listener. Net: treat as a patch-in-normal-cycle item, not an emergency, unless the affected component is exposed in an untrusted context.

An attacker supplies a crafted file name or path value that a Visual Studio or Microsoft.Diagnostics.Runtime component consumes without proper canonicalization, causing a higher-privileged .NET process to read from or write to an attacker-chosen location and thereby run attacker-controlled code or overwrite trusted files, elevating privilege. Because CVSS marks AC:H, the attacker must satisfy non-trivial preconditions (specific input timing or a particular diagnostics/debugging workflow). No public proof-of-concept exists at time of analysis.