What is the CVSS score of EUVD-2026-44397?

EUVD-2026-44397 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of .NET Framework are affected by EUVD-2026-44397?

Microsoft .NET Framework and Visual Studio versions 3.5-4.8.1, 8.0, 9.0, and 2022-2026 contain a local code execution vulnerability triggered when users open malicious files, with no public exploit…. A patch is available.

How to fix or mitigate EUVD-2026-44397?

Within 24 hours, inventory all systems running affected Microsoft .NET Framework versions (3.5-4.8.1, 8.0, 9.0) and Visual Studio editions (2022, 2026), prioritizing development workstations and servers hosting .NET applications. Within 7 days, deploy the vendor-released patch to critical-tier systems (development, production) and begin staged rollout to other environments using Windows Update or Microsoft's security guidance. Within 30 days, complete patching across all inventory, including legacy and non-production systems, and validate the update through targeted testing of .NET applications in each environment.

.NET Framework EUVD-2026-44397

| CVE-2026-50646 HIGH

Protection Mechanism Failure (CWE-693)

2026-07-14 microsoft

GHSA-gh2h-rhph-h37g

Authentication Bypass Microsoft Red Hat Suse Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.8 HIGH

Local file/project delivery gives AV:L with UI:R for the victim opening it; no app privileges needed (PR:N); code execution in user context yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.8 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:53 vuln.today

CVE Published

Jul 14, 2026 - 19:29 nvd

HIGH 7.8

DescriptionCVE.org

Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft .NET (Framework 3.5 through 4.8.1, .NET 8.0/9.0, and Visual Studio 2022/2026) arises from a protection mechanism failure (CWE-693) that lets an unauthorized attacker run arbitrary code once a victim is lured into opening a malicious file or project. The flaw requires user interaction (UI:R) and local delivery (AV:L) but no prior privileges (PR:N), yielding high confidentiality, integrity, and availability impact and a 7.8 CVSS score. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the ubiquity of .NET on Windows makes patching a priority.

Technical ContextAI

The affected component is Microsoft's .NET runtime and framework stack, spanning the legacy .NET Framework (3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8, 4.8.1) shipped with Windows and the modern cross-platform .NET 8.0/9.0 runtimes, plus the Visual Studio 2022 (17.12/17.14) and 2026 (18.7) tooling that bundles them, per the supplied CPE list. CWE-693 (Protection Mechanism Failure) indicates that a security control the runtime relies on - such as a sandbox, trust boundary, or bypassable authentication/validation check (the intel tags this as an Authentication Bypass class) - does not function as intended, allowing untrusted input to reach a code path that executes with the user's privileges. Because the same defect spans both the in-box Windows .NET Framework and the redistributable .NET 8/9 runtimes, the exposed surface includes desktop applications, developer machines, and build environments.

RemediationAI

Apply the vendor patch: Patch available per vendor advisory (Microsoft) - install the security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50646 for each affected component, which for the in-box .NET Framework arrive via the monthly Windows cumulative/security-only updates and for .NET 8.0/9.0 via the corresponding runtime servicing release, while Visual Studio 2022 (17.12/17.14) and 2026 (18.7) are fixed through their in-product updater. Prioritize developer workstations and build agents given the Visual Studio exposure. Because exploitation depends on a user opening malicious content, sound interim compensating controls are to restrict opening untrusted files/projects and enforce Mark-of-the-Web/Protected View and SmartScreen (trade-off: does not close the underlying flaw and can be bypassed by social engineering), remove or update end-of-support .NET Framework versions that no longer receive fixes, and apply application allowlisting to limit which binaries can execute (trade-off: administrative overhead and potential to block legitimate developer tooling). Exact fixed version numbers are not present in the provided data and should be taken directly from the MSRC advisory rather than assumed.