CVE-2026-70161

.NET Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-70165

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-85363

.NET Framework Elevation of Privilege Vulnerability

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-96235

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96237

.NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-102870

ASP.NET Core Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 10 more

CVE-2026-96222

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 26 more

CVE-2026-85790

Microsoft QUIC Information Disclosure Vulnerability

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft.native.quic.msquic.schannel Microsoft Visual Studio 2026 and 17 more

CVE-2026-70162

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Redhat

Products

Microsoft Visual Studio 2026 Version 18.10 System.security.cryptography.pkcs Visual Studio 2022 and 1 more

CVE-2026-96234

.NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 and 1 more

CVE-2026-96230

ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft.aspnetcore.components.webassembly.server Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-96236

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-83520

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-88092

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 and 1 more

CVE-2026-70188

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70190

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70196

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70186

ASP.NET Core Denial of Service Vulnerability

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-103572

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70183

ASP.NET Core Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022