EUVD-2026-56408
GHSA-23fw-v26w-5fgq
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable unauthenticated path with high-complexity gate; impact is confidentiality-only with no integrity or availability dimension, unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
Technical ContextAI
CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer) describes a class of flaws where an application fails to scrub sensitive data - such as credentials, tokens, private keys, or PII - before transmitting or storing it. In the context of Microsoft .NET runtimes (8.0, 9.0, 10.0) and the Visual Studio 2022 and 2026 SDK toolchains, the flaw manifests in a network-reachable code path where sensitive runtime or application-level data is not stripped before being sent across a network boundary. The high attack complexity (AC:H) in the CVSS vector suggests that exploitation requires satisfying specific conditions - such as a precise timing window, a particular application state, or a specific request sequence - rather than simple opportunistic access. The exact internal .NET subsystem involved is not disclosed in the available NVD description or MSRC advisory text.
RemediationAI
The primary fix is to upgrade to the vendor-released patched versions: .NET 8.0 users should update to 8.0.30 or later; .NET 9.0 users should update to 9.0.19 or later; .NET 10.0 users should update to 10.0.11 or later. Visual Studio 2022 version 17.14 users should update to 17.14.38 or later, and Visual Studio 2026 version 18.8 users should update to 18.8.3 or later. Full patch details are available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62900. For environments where immediate patching is not feasible, network-level controls such as restricting external access to .NET application endpoints and deploying egress filtering to limit what data can leave application hosts may reduce exposure as compensating controls - however, these do not address the root cause and should not substitute for patching. Given the AC:H constraint, network segmentation reducing the pool of attackers who could satisfy the triggering conditions offers additional risk reduction.
More in Visual Studio 2022
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service ove
Heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio allows a network-based unauthenticated attacker
Heap-based buffer overflow in Microsoft Visual Studio 2022 and 2026 enables network-delivered remote code execution when
Privilege escalation in Microsoft .NET runtimes (8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022 and 2026 results f
Heap-based buffer overflow (CWE-122) in Microsoft .NET enables local code execution across all actively supported .NET r
Local code execution via out-of-bounds write in Microsoft .NET allows an unauthenticated local attacker to achieve full
Local privilege escalation in Microsoft .NET (versions 8.0, 9.0, and 10.0) and Microsoft Visual Studio 2022/2026 allows
Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang
Integer overflow in Microsoft .NET Framework and modern .NET runtimes enables local code execution with full process com
Use-after-free memory corruption in Microsoft's QUIC protocol implementation (MsQuic) exposes sensitive heap memory to u
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today