What is the CVSS score of EUVD-2026-44394?

EUVD-2026-44394 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate EUVD-2026-44394?

Within 24 hours, audit deployments of .NET 8.0, 9.0, and 10.0, and Visual Studio 2022 (versions 17.12, 17.14) and 2026 (version 18.7) to identify affected systems, prioritizing build servers and CI/CD environments. Within 7 days, apply the vendor-released patch to development and build systems (prioritize these as they are higher-value targets for local attackers). Within 30 days, complete patch deployment across all remaining .NET and Visual Studio installations, including developer workstations and test environments.

.NET EUVD-2026-44394

Q: Which versions of .NET are affected by EUVD-2026-44394?

Microsoft .NET and Visual Studio contain a local privilege-escalation vulnerability affecting build and development infrastructure across versions 8.0-10.0 (.NET) and 17.12-18.7 (Visual Studio).. A patch is available.

| CVE-2026-50526 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-07-14 microsoft

GHSA-55jh-fwmh-39m4

Information Disclosure Microsoft Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

5.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain low-privileged local account
Delivery

Stage symlink/junction on target path
Exploit

Trigger privileged .NET or build file operation
Execution

Win TOCTOU race to redirect write
Persist

Tamper with or overwrite protected file
Impact

Leverage for escalation or integrity loss

Vulnerability Assessment

Weakness	CWE CWE-59 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V5 - File Handling Symlink resolution safety
Exploitation Conditions	Exploitation requires the attacker to already have a low-privileged authenticated local account (PR:L) on the machine running the affected .NET runtime/SDK or Visual Studio, and the ability to create symbolic/hard links or junctions on the target filesystem (on Windows, symlink creation is privileged by default, which is a meaningful limiter). The attacker must then win a time-of-check/time-of-use race against a privileged .NET or build-tool file operation (AC:H), so exploitation depends on that operation being triggerable and on precise timing rather than any special product feature flag. No user interaction is needed (UI:N) and no remote access is possible (AV:L, network exploitation is out of scope). Limiting factors: local access mandatory, high complexity/race condition, and - on default Windows - the restricted symlink privilege.
Impact	The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.0) describes a locally exploitable flaw needing an already-authenticated low-privileged user and a hard-to-win race (AC:H), but full high impact to confidentiality, integrity, and availability once won. That impact profile conflicts with the terse description, which characterizes the effect only as 'tampering' (integrity), and with the vendor tag 'Information Disclosure' (confidentiality) - the three signals disagree on the primary impact, so defenders should treat the full C/I/A claim as the conservative bound and verify the concrete effect against the MSRC advisory. No EPSS score, no SSVC decision, and no POC were provided; combined with the local-only vector, high complexity, and absence from CISA KEV, this is a moderate-priority patch rather than an emergency. It matters most on multi-user servers and shared developer/build machines where a low-privileged user could leverage it toward privilege escalation or build tampering.
Exploit ScenarioDerived	A low-privileged user on a shared build server or multi-tenant host pre-plants a symbolic link (or wins a race by swapping a directory for a link) at a path that a higher-privileged .NET or Visual Studio build operation is about to write to, causing that trusted process to overwrite or create a file at an attacker-controlled location. Because the race is timing-sensitive (AC:H) the attacker may need many attempts, but success can corrupt sensitive files or plant content used for later privilege escalation. No public proof-of-concept was identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Local tampering via symbolic-link following in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the bundled toolchain in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) allows an authorized local attacker to redirect a privileged file operation to an unintended target, corrupting or replacing files outside their normal permissions. Microsoft (the reporter) has released a fix; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The high CVSS 3.1 base score of 7.0 is tempered by high attack complexity and the requirement for existing low-level local access.

RemediationAI

Patch available per vendor advisory: apply the Microsoft update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50526, which covers the affected .NET 8.0/9.0/10.0 runtimes and SDKs and the Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) packages - the exact fixed version numbers are enumerated in that advisory and should be pulled from there rather than assumed. Update .NET via the OS/servicing channel or a fresh SDK/runtime installer, and update Visual Studio through the Visual Studio Installer to the latest servicing build of each listed version. Until patched, reduce exposure by limiting interactive and local logon rights on servers and build agents so untrusted low-privileged users cannot stage symlinks, tightening ACLs on directories where .NET/build processes create or write files, and, on Windows, restricting the ability to create symbolic links (the SeCreateSymbolicLinkPrivilege, granted only to administrators by default) - note these controls constrain legitimate multi-user and CI scenarios and are stopgaps, not a substitute for the update.

Affected VersionsENISA

.NET 9.0 9.0.0 <9.0.18

.NET 8.0 8.0.0 <8.0.29

.NET 10.0 10.0.0 <10.0.6

Microsoft Visual Studio 2026 version 18.7 18.0 <18.7.4

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.36

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.22

Affected Packages

nuget microsoft.net.build.containers fix: 8.0.29, 9.0.18, 10.0.10

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.22

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.36

euvd microsoft_visual_studio_2026_version_18_7 fix: 18.7.4

euvd net_10_0 fix: 10.0.6

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 7 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-59 (Improper Link Resolution Before File Access, 'link following'). A process - here a .NET runtime/SDK component or a Visual Studio build/tooling operation - resolves a filesystem path without first verifying that an intermediate directory or the final path element is a genuine file rather than a symbolic link, hard link, or junction. An attacker who can place or swap such a link between the time the path is checked and the time it is used (a classic TOCTOU race, consistent with the AC:H rating) causes the trusted process to read from or write to an attacker-chosen location. The affected CPEs pinpoint the Microsoft .NET 8.0/9.0/10.0 runtimes plus the Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) packages that ship the vulnerable .NET components, so both server/runtime hosts and developer workstations are in scope.

Know when Net 10 0 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY HIGH

NVD 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

ENISA EUVD HIGH

vuln.today AI 6.5 MEDIUM

Local low-priv attacker winning a symlink TOCTOU race (AV:L/AC:H/PR:L); description emphasizes tampering so I:H/A:H, with only limited confidentiality (C:L) since impact is redirected file writes.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.0 MEDIUM

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Jul 22, 2026 - 17:37 NVD

HIGH MEDIUM

CVSS changed

Jul 22, 2026 - 17:37 NVD

7.0 (HIGH) 5.5 (MEDIUM)

CVE Published

Jul 14, 2026 - 19:29 nvd

HIGH 7.0

DescriptionNVD

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Executive ViewAI

Why It Matters

Microsoft .NET and Visual Studio contain a local privilege-escalation vulnerability affecting build and development infrastructure across versions 8.0-10.0 (.NET) and 17.12-18.7 (Visual Studio). Insider threats or local users on development systems could escalate permissions and modify critical files; impact is highest on CI/CD and build pipelines where code is compiled and deployed. Organizations must patch immediately to protect the integrity of their software supply chain.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Ubiquitous

.NET runtime and SDK deployed across vast numbers of Windows/enterprise systems

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

9 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.