CVE-2026-62902

Summary

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

Affected Software

VendorProductVersion RangeStatus
Microsoft.NET 10.010.0.0 < 10.0.11affected
Microsoft.NET 8.08.0.0 < 8.0.30affected
Microsoft.NET 9.09.0.0 < 9.0.19affected
MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 < 17.14.38affected
MicrosoftMicrosoft Visual Studio 2026 version 18.818.0 < 18.8.3affected

Weaknesses

  • CWE-829: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
  • CWE-693: CWE-693: Protection Mechanism Failure
  • CWE-918: CWE-918: Server-Side Request Forgery (SSRF)

References