CVE-2026-62886: .NET Elevation of Privilege Vulnerability

CVE-2026-62886 is an elevation of privilege vulnerability in .NET, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.47% probability of exploitation activity in the next 30 days, higher than 41% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 29 security updates (KB5127660, KB5126044, KB5126049, KB5126051 and more). It affects 62 products in 1 product family (Developer Tools).

Key facts

CVE ID: CVE-2026-62886
Severity: High CVSS 7.8
Microsoft severity: Important
Impact: Elevation of Privilege
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: Less Likely
Weakness: CWE-122; CWE-190
EPSS: 0.47% (percentile 41%)
CISA KEV: Not listed
Released: 11 August 2026
Last updated: 17 August 2026
Patch Tuesday: August 2026 Patch Tuesday
Product families: Developer Tools

CVSS score and vector

Microsoft scores CVE-2026-62886 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	Required
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.

Frequently asked questions (Microsoft)

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of this vulnerability requires that a user trigger the payload in the application.

Affected products (62)

Developer Tools

Product	Security update	Type	Fixed build	Restart
Microsoft .NET Framework 3.5 on Windows Server 2012	KB5127660	Security Update	2.0.50727.8987 AND 3.0.30729.8982	Maybe
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012	KB5126044	Security Update	4.7.4145.0	Maybe
Microsoft .NET Framework 4.8 on Windows Server 2012	KB5126049	Security Update	4.8.4806.0	Maybe
Microsoft .NET Framework 4.8 on Windows Server 2012 R2	KB5126051	Security Update	4.8.4806.0	Maybe
Microsoft .NET Framework 4.8 on Windows Server 2016	KB5126047	Security Update	4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019	KB5127666	Security Update	2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019	KB5127685	Security Update	2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022	KB5127693	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for 32-bit Systems	KB5126043	Security Update	2.0.50727.9070 & 3.0.30729.9068 & 4.7.4145.0	Maybe
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for ARM64-based Systems	KB5126043	Security Update	2.0.50727.9070 & 3.0.30729.9068 & 4.7.4145.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for 32-bit Systems	KB5126421	Security Update	2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for ARM64-based Systems	KB5126421	Security Update	2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 1809 for x64-based Systems	KB5126421	Security Update	2.0.50727.9070 & 3.0.30729.9068 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for 32-bit Systems	KB5126046	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for 32-bit Systems
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for x64-based Systems
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for 32-bit Systems
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for ARM64-based Systems
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 25H2 for ARM64-based Systems	KB5126052	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0	Maybe
Microsoft .NET Framework 3.5 on Windows 11 Version 26H1 for ARM64-based Systems	KB5120747	Security Update	2.0.50727.9183 & 3.0.30729.9169	Maybe
Microsoft .NET Framework 3.5 on Windows 11 version 26H1 for x64-based Systems	KB5120747	Security Update	2.0.50727.9183 & 3.0.30729.9169	Maybe
Microsoft .NET Framework 4.8.1 on Windows 11 Version 26H1 for ARM64-based Systems	KB5126053	Security Update	4.8.9347.0	Maybe
Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1 for x64-based Systems	KB5126053	Security Update	4.8.9347.0	Maybe
Microsoft .NET Framework 3.5 on Windows Server 2012 R2	KB5127664	Security Update	2.0.50727.8987 AND 3.0.30729.8982	Maybe
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2	KB5126045	Security Update	4.7.4145.0	Maybe
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016	KB5126868	Security Update	2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022	KB5127687	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025	KB5127690	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems	KB5123099	Security Update	2.0.50727.8984 & 3.0.30729.8980 & 4.7.4145.0	Maybe
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems	KB5123099	Security Update	2.0.50727.8984 & 3.0.30729.8980 & 4.7.4145.0	Maybe
Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for 32-bit Systems	KB5126047	Security Update	4.8.4806.0	Maybe
Microsoft .NET Framework 4.8 on Windows 10 Version 1607 for x64-based Systems	KB5126047	Security Update	4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 Version 1809 for x64-based Systems	KB5126043	Security Update	2.0.50727.9070 & 3.0.30729.9068 & 4.7.4145.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for ARM64-based Systems	KB5126046	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 21H2 for x64-based Systems	KB5126046	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 21H2 for ARM64-based Systems
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for 32-bit Systems	KB5126046	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for ARM64-based Systems	KB5126046	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 Version 22H2 for x64-based Systems	KB5126046	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.4806.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 Version 22H2 for x64-based Systems
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 23H2 for ARM64-based Systems	KB5126424	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 23H2 for x64-based Systems	KB5126424	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 24H2 for ARM64-based Systems	KB5126052	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 24H2 for x64-based Systems	KB5126052	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 Version 25H2 for x64-based Systems	KB5126052	Security Update	2.0.50727.9183 & 3.0.30729.9169 & 4.8.9347.0	Maybe
Microsoft Visual Studio 2026 version 18.8	Security update	Security Update	18.8.3
.NET 10.0 runtime installed on Windows	KB5122106	Security Update	10.0.11	Maybe
.NET 8.0 runtime installed on Windows	KB5122104	Security Update	8.0.30	Maybe
.NET 9.0 runtime installed on Windows	KB5122105	Security Update	9.0.19	Maybe
Microsoft Visual Studio 2022 version 17.14	Security update	Security Update	17.14.38
Microsoft .NET Framework 3.5 on Windows 11 version 26H1	KB5127696	Security Update	2.0.50727.9188 AND 3.0.30729.9171	Maybe
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607	KB5126868	Security Update	2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0	Maybe
Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809	KB5127666	Security Update	2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809	KB5127685	Security Update	2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2	KB5127683	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2	KB5127683	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2	KB5127689	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2	KB5127689	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2	KB5127690	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2	KB5127690	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2	KB5127692	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0	Maybe
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2	KB5127694	Security Update	2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0	Maybe

Security updates (29)

KB5127660 (Security Update)
KB5126044 (Security Update)
KB5126049 (Security Update)
KB5126051 (Security Update)
KB5126047 (Security Update)
KB5127666 (Security Update)
KB5127685 (Security Update)
KB5127693 (Security Update)
KB5126043 (Security Update)
KB5126421 (Security Update)
KB5126046 (Security Update)
KB5126052 (Security Update)
KB5120747 (Security Update)
KB5126053 (Security Update)
KB5127664 (Security Update)
KB5126045 (Security Update)
KB5126868 (Security Update)
KB5127687 (Security Update)
KB5127690 (Security Update)
KB5123099 (Security Update)
KB5126424 (Security Update)
KB5122106 (Security Update)
KB5122104 (Security Update)
KB5122105 (Security Update)
KB5127696 (Security Update)
KB5127683 (Security Update)
KB5127689 (Security Update)
KB5127692 (Security Update)
KB5127694 (Security Update)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 7.8 (HIGH)
NVD weakness: CWE-122; CWE-190
Published to NVD: 11 August 2026
NVD last modified: 14 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
visual studio 2022	from 17.14.0, before 17.14.38
visual studio 2026	from 18.8.0, before 18.8.3
.net	from 8.0.0, before 8.0.30
.net	from 9.0.0, before 9.0.19
.net	from 10.0.0, before 10.0.11

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62886 (Patch, Vendor Advisory)

Acknowledgments

41ae55e9310ff27fa6f26af4727e5590
kai63001
Ky0toFu
Ngoc Hieu from Vinfast
s3zer0
zpbrent

Revision history

Version	Date	Description
1.0	11 August 2026	Information published.
2.0	13 August 2026	Removed Linux and macOS products from the Affected Software table. This is an informational change only.
2.1	17 August 2026	Acknowledgement Updated