CVE-2026-62900: .NET Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 5.9)
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Aug
Released
2026-08-11

Description

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.

FAQ

What type of information could be disclosed by this vulnerability? Exploiting this vulnerability could allow the disclosure of credentials. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires that the target system be set up in a specific manner and the attacker to have knowledge of that setup.

Affected Products (10)

Developer Tools

  • Microsoft Visual Studio 2026 version 18.8
  • .NET 10.0 installed on Mac OS
  • .NET 10.0 installed on Linux
  • .NET 8.0 installed on Windows
  • .NET 8.0 installed on Linux
  • .NET 8.0 installed on Mac OS
  • .NET 9.0 installed on Linux
  • .NET 9.0 installed on Mac OS
  • .NET 9.0 installed on Windows
  • Microsoft Visual Studio 2022 version 17.14

Security Updates (3)

Acknowledgments

Ivan Demchuk

Revision History

  • 2026-08-11: Information published.