DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-62902: CVE-2026-62902: .NET and Visual Studio Information Disclosure Vulnerability

#security #cve #cybersecurity

CVE-2026-62902: .NET and Visual Studio Information Disclosure Vulnerability

Vulnerability ID: CVE-2026-62902
CVSS Score: 6.5
Published: 2026-08-11

An information disclosure vulnerability in Microsoft .NET and Microsoft Visual Studio allows an unauthorized remote attacker to trigger outbound network requests (SSRF) and disclose sensitive environment data by leveraging untrusted inputs and user interaction.

TL;DR

Microsoft .NET and Visual Studio fail to restrict the resolution of external resources, enabling remote attackers to leak sensitive credentials and internal metadata via crafted files and Server-Side Request Forgery.

Technical Details

  • CWE ID: CWE-829, CWE-693, CWE-918
  • Attack Vector: Network (AV:N)
  • Attack Complexity: Low (AC:L)
  • Privileges Required: None (PR:N)
  • User Interaction: Required (UI:R)
  • CVSS v3.1 Score: 6.5 (Medium)
  • Exploit Status: None
  • CISA KEV Status: Not Listed

Affected Systems

  • Microsoft .NET 8.0
  • Microsoft .NET 9.0
  • Microsoft .NET 10.0
  • Microsoft Visual Studio 2022 version 17.14
  • Microsoft Visual Studio 2026 version 18.8
  • Microsoft .NET 8.0: 8.0.0 to < 8.0.30 (Fixed in: 8.0.30)
  • Microsoft .NET 9.0: 9.0.0 to < 9.0.19 (Fixed in: 9.0.19)
  • Microsoft .NET 10.0: 10.0.0 to < 10.0.11 (Fixed in: 10.0.11)
  • Microsoft Visual Studio 2022 version 17.14: 17.14.0 to < 17.14.38 (Fixed in: 17.14.38)
  • Microsoft Visual Studio 2026 version 18.8: 18.0 to < 18.8.3 (Fixed in: 18.8.3)

Mitigation Strategies

  • Apply the August 2026 security updates for .NET and Visual Studio.
  • Block outbound SMB (ports 139 and 445) to prevent NTLM credential harvesting.
  • Enforce outbound network filtering to restrict servers and development workstations from accessing unapproved external domains.

Remediation Steps:

  1. Upgrade .NET 8.0 instances to version 8.0.30 or higher.
  2. Upgrade .NET 9.0 instances to version 9.0.19 or higher.
  3. Upgrade .NET 10.0 instances to version 10.0.11 or higher.
  4. Update Visual Studio 2022 to version 17.14.38 or higher and Visual Studio 2026 to version 18.8.3 or higher.
  5. Implement network-level blocking of outbound TCP ports 139 and 445.

References

Read the full report for CVE-2026-62902 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)