CVE-2026-96225

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96229

.NET Information Disclosure Vulnerability

Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96238

.NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96957

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 5 more

CVE-2026-58280

.NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-102869

.NET and Visual Studio Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-105016

Microsoft QUIC Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.7% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 14 more

CVE-2026-109468

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 System.formats.cbor and 1 more

CVE-2026-118147

Visual Studio Spoofing Vulnerability

Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Visual Studio 2017 Version 15.9 Microsoft Visual Studio 2019 Version 16.11 Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2023-36049

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

CVSS 3.1 · 7.6 High EPSS 6.8% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net .net Framework Visual Studio and 16 more

CVE-2021-43877

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Visual Studio 2019 Visual Studio 2022

CVE-2026-70161

.NET Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-70165

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-85363

.NET Framework Elevation of Privilege Vulnerability

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2022 Version 17.14 and 2 more

CVE-2026-96235

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-96237

.NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2022 Version 17.14 Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-102870

ASP.NET Core Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows and 10 more

CVE-2026-96222

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 26 more

CVE-2026-85790

Microsoft QUIC Information Disclosure Vulnerability

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft.native.quic.msquic.schannel Microsoft Visual Studio 2026 and 17 more

CVE-2022-24513

Visual Studio Elevation of Privilege Vulnerability

Visual Studio Elevation of Privilege Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Visual Studio 2017 Visual Studio 2019 Visual Studio 2022