.NET Elevation of Privilege Vulnerability
Impact
Microsoft .NET products, including Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.9, have an elevation of privilege vulnerability due to external control of file name or path. An attacker with network access may exploit this weakness. The impact is uncertain.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Microsoft · microsoft
Microsoft Visual Studio 2022 version 17.14
1 range
Microsoft · microsoft
Microsoft Visual Studio 2022 version 17.14
Compare with this publisher’s ranges. This does not inspect your installation.
affected
17.14.0 → before 17.14.40
custom versions
Other versions: unknown
Microsoft · microsoft
Microsoft Visual Studio 2026 version 18.9
1 range
Microsoft · microsoft
Microsoft Visual Studio 2026 version 18.9
Compare with this publisher’s ranges. This does not inspect your installation.
affected
18.9.0 → before 18.9.3
custom versions
Other versions: unknown
Microsoft · microsoft
Microsoft.Diagnostics.Runtime
1 range
Microsoft · microsoft
Microsoft.Diagnostics.Runtime
Compare with this publisher’s ranges. This does not inspect your installation.
affected
4.1.740301 → before 4.1.740301
custom versions
Other versions: unknown
Original source description
External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-69805View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
microsoft · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*From (inclusive): 17.14.0
Before: 17.14.40
Vulnerable product
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*From (inclusive): 18.9.0
Before: 18.9.3
Vulnerable product
cpe:2.3:a:microsoft:diagnostics_runtime:*:*:*:*:*:*:*:*From (inclusive): 4.1.740301
Before: 4.1.740301
Original applicability statements
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
"versionStartIncluding": "17.14.0",
"versionEndExcluding": "17.14.40"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*",
"versionStartIncluding": "18.9.0",
"versionEndExcluding": "18.9.3"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:microsoft:diagnostics_runtime:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.740301",
"versionEndExcluding": "4.1.740301"
}
]
}
]
}
]Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.