{"id":"CVE-2026-62901","aliases":[],"cve":{"records":[{"id":"CVE-2026-62901","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T21:25:21.035Z","published":"2026-08-11T17:04:41.393Z","modified":"2026-10-30T17:20:28.461Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T17:20:28.461Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-12T15:28:26.506Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62901","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-606","description":"CWE-606: Unchecked Input for Loop Condition","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*","versionStartIncluding":"18.0","versionEndExcluding":"18.8.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.30"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.19"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.14.0","versionEndExcluding":"17.14.38"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-12T15:28:12.602676Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":".NET Denial of Service Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.","score":7.5,"severity":"high","published":"2026-08-11T17:04:41.393Z","modified":"2026-10-30T17:20:28.461Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":".NET 10.0 runtime","platforms":[],"versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.11","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"},{"vendor":"Microsoft","name":".NET 8.0 runtime","platforms":[],"versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.30","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"},{"vendor":"Microsoft","name":".NET 9.0 runtime","platforms":[],"versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.19","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"},{"vendor":"Microsoft","name":"Microsoft Visual Studio 2022 version 17.14","platforms":[],"versions":[{"version":"17.14.0","status":"affected","lessThan":"17.14.38","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"},{"vendor":"Microsoft","name":"Microsoft Visual Studio 2026 version 18.8","platforms":[],"versions":[{"version":"18.0","status":"affected","lessThan":"18.8.3","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62901"],"sources":[{"name":"CVE","id":"CVE-2026-62901","modified":"2026-10-30T17:20:28.461Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T18:44:44.397Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"A .NET vulnerability allows an unauthorized attacker to deny service over a network due to unchecked input for loop condition. The affected products include .NET 8.0, 9.0, and 10.0 runtime, as well as Microsoft Visual Studio 2022 and 2026. The weakness is identified as CWE-606: Unchecked Input for Loop Condition.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T10:50:13.679Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-62901"}]}}