CVE-2026-62900

Imagine your application is passing along private information, but .NET accidentally leaves that information where it shouldn’t. If an attacker can reach the service over the network, they may be able to view that secret information intended only for your system. This is like leaving a confidential document where a visitor can read it through the window.

This matters if your business runs apps or development environments built on .NET (including Visual Studio 2022 or Visual Studio 2026) and you have a vulnerable .NET component in use. The risk is network-based and does not require an attacker to log in, and it’s reachable in default configurations. Act now if the vulnerable component is reachable over the network; otherwise the exposure is limited.

This should be treated as urgent because the issue is a network-reachable information leak that does not require an attacker login. Even though there’s no confirmed public exploit code and no KEV listing, the fixed versions are already available and recent patch activity indicates active attention. With a RED verdict, upgrade promptly to eliminate the chance of data exposure.

Confirm whether you’re affected

1. Identify where the vulnerable code is running:
   • Production servers hosting your .NET apps (the running runtime matters).
   • Any environments where Visual Studio 2022/2026 is used to build/test apps (depending on your workflow, but patching dev tools is still important).
2. Check installed versions:
   • For Visual Studio: confirm your exact Visual Studio 2022 version and whether it matches 17.14 and your patch level is below 17.14.38; confirm Visual Studio 2026 version and whether it matches 18.8 and your patch level is below 18.8.3.
   • For .NET runtime/framework: confirm which line you use (.NET 8.0, .NET 9.0, .NET 10.0) and whether it is below the fixed patch levels.

Upgrade to the fixed versions

• Visual Studio 2022: update to 17.14.38
• Visual Studio 2026: update to 18.8.3
• .NET 8.0: update to 8.0.30
• .NET 9.0: update to 9.0.19
• .NET 10.0: update to 10.0.11

If you can’t patch right away (temporary containment)

1. Reduce network exposure:
   • Restrict inbound access (firewalls/security groups) so only required clients can reach the service that uses the vulnerable .NET component.
2. If your architecture allows it, limit which endpoints are publicly reachable while upgrading is in progress.
3. Keep an eye on access logs/web server logs for unusual requests reaching the vulnerable service.

What to monitor after patching

• Application/server logs for errors or abnormal traffic patterns around the time of upgrade.
• Any security tooling alerts related to information disclosure attempts.

Timing note

• No KEV listing was provided, and there’s no clear dated press claim of exploitation in the findings. However, because the verdict is RED and the vulnerability is network-reachable, prioritize upgrading as soon as possible.

CVE-2026-62900 is an information disclosure issue (CWE-212) in .NET caused by improper handling that fails to remove sensitive information before storage or transfer. The findings indicate:

• Attack characteristics: network-based, no authentication required, and no user interaction.
• Reachability: reachable in default configuration when the vulnerable .NET component is used.
• Impact: an attacker can view sensitive or private data intended only for the target system.
• Exploitation context: no KEV entry was listed and no public exploit code was found in the provided findings; there is patch-related attention (including reporting that an actor associated with Lazarus group was involved with patch attention), but the findings do not provide a dated exploitation claim.
• Patch availability: fixed versions are available for Visual Studio 2022 (17.14.38) and Visual Studio 2026 (18.8.3), and for .NET runtime lines (.NET 8.0: 8.0.30; .NET 9.0: 9.0.19; .NET 10.0: 10.0.11).
• EPSS: a prediction was provided (trend flat), but since exploitation confirmation via KEV/news was not provided in the findings, the operational priority is driven by the RED verdict and the network/unauthenticated exposure characteristics.