What is the CVSS score of EUVD-2026-56409?

EUVD-2026-56409 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

Which versions of .NET are affected by EUVD-2026-56409?

Microsoft .NET runtime and Visual Studio environments face a high-severity denial-of-service vulnerability affecting versions 8.0 through 10.0, which allows unauthenticated remote actors to crash…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-56409?

Yes, a public proof-of-concept exploit is available for EUVD-2026-56409. Prioritise patching immediately. EPSS: 1.1%.

How to fix or mitigate EUVD-2026-56409?

Within 24 hours, identify all .NET applications in production and development, categorize by business criticality and external exposure, and verify current version status against affected releases (8.0 through 8.0.29, 9.0 through 9.0.18, 10.0 through 10.0.10) and Visual Studio 2022/2026. Within 7 days, validate the latest vendor patch in a staging environment, coordinate with development and operations teams, and schedule deployment windows that minimize business impact. Within 30 days, deploy patches to all production .NET runtimes and development environments, confirming successful rollout and monitoring for any application stability issues post-patch.

.NET EUVD-2026-56409

| CVE-2026-62901 HIGH

Unchecked Input for Loop Condition (CWE-606)

2026-08-11 secure@microsoft.com

GHSA-m93f-wj8c-rp8p

Authentication Bypass Microsoft Red Hat Visual Studio 2022 Suse Net Visual Studio 2026

7.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

7.5 HIGH

Network-reachable, no auth or interaction required; impact is availability-only with no confidentiality or integrity consequence per description and CVSS.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 18:59 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.5

DescriptionCVE.org

Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial-of-service in Microsoft .NET runtimes and Visual Studio allows unauthenticated remote attackers to crash or hang .NET applications by supplying crafted input that exploits an unchecked loop termination condition. Affected are .NET 8.0 (all releases through 8.0.29), .NET 9.0 (through 9.0.18), .NET 10.0 (through 10.0.10), and bundled Visual Studio 2022 and 2026 installations. No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication requirement make this a credible automated threat against any internet-exposed .NET service. Vendor-released patches are available and should be applied promptly, particularly for externally reachable endpoints. Note: the ENISA EUVD tags this as 'Authentication Bypass,' which conflicts with the description and CVSS impact metrics (C:N/I:N/A:H); this discrepancy should be verified with Microsoft's advisory.

Technical ContextAI

CWE-606 (Unchecked Loop Condition) describes a class of defect where program logic uses externally-supplied data to govern a loop's iteration count or exit condition without adequate validation of bounds or termination criteria. In .NET, this pattern can appear in serialization parsers, protocol handlers, or format-decoding routines that process attacker-controlled byte streams. Because the loop never terminates (or iterates an extreme number of times), the affected thread or process consumes CPU and/or memory until it is killed or the host is starved of resources. The vulnerability spans three active .NET release trains - 8.0 (LTS), 9.0 (STS), and 10.0 - and also affects Visual Studio 2022 17.14.x and Visual Studio 2026 18.8.x, which bundle embedded .NET runtimes. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the vulnerable code path is reachable over the network without authentication or user interaction, indicating it resides in a network-facing parser or request-handling layer rather than a local-only subsystem.

RemediationAI

The primary remediation is to upgrade to the patched release for each affected product: .NET 8.0.30, .NET 9.0.19, .NET 10.0.11, Visual Studio 2022 17.14.38, or Visual Studio 2026 18.8.3. These versions are confirmed as fix boundaries by the ENISA EUVD-2026-56409 affected-version data. Microsoft's update guidance is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62901. For environments where immediate patching is not feasible, a compensating control is to place a reverse proxy or web application firewall in front of any internet-exposed .NET service and configure request size and connection timeout limits to terminate connections that send unusually large or slow payloads - this may reduce blast radius but will not eliminate the underlying flaw. Restricting unauthenticated network access to affected .NET endpoints via network-layer ACLs is a second compensating option, though this may impact legitimate service availability. Side effect of the patched upgrade: Visual Studio updates may reset certain IDE configurations and require restarting active development environments.