{"id":"CVE-2026-62902","aliases":[],"cve":{"records":[{"id":"CVE-2026-62902","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T21:25:21.035Z","published":"2026-08-11T17:04:42.081Z","modified":"2026-10-30T17:20:28.896Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T17:20:28.896Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-12T13:35:41.649Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62902","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-829","description":"CWE-829: Inclusion of Functionality from Untrusted Control Sphere","source":"microsoft"},{"id":"CWE-693","description":"CWE-693: Protection Mechanism Failure","source":"microsoft"},{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.30"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.19"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.14.0","versionEndExcluding":"17.14.38"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*","versionStartIncluding":"18.0","versionEndExcluding":"18.8.3"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-12T13:29:33.987288Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":".NET Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.","score":6.5,"severity":"medium","published":"2026-08-11T17:04:42.081Z","modified":"2026-10-30T17:20:28.896Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":".NET 8.0 runtime","platforms":[],"versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.30","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62902"},{"vendor":"Microsoft","name":".NET 9.0 runtime","platforms":[],"versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.19","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62902"},{"vendor":"Microsoft","name":"Microsoft Visual Studio 2022 version 17.14","platforms":[],"versions":[{"version":"17.14.0","status":"affected","lessThan":"17.14.38","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62902"},{"vendor":"Microsoft","name":"Microsoft Visual Studio 2026 version 18.8","platforms":[],"versions":[{"version":"18.0","status":"affected","lessThan":"18.8.3","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-62902"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62902"],"sources":[{"name":"CVE","id":"CVE-2026-62902","modified":"2026-10-30T17:20:28.896Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62902"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-30T18:44:45.912Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:25:31.632Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The .NET 8.0 and 9.0 runtimes, and Microsoft Visual Studio 2022 and 2026, have an information disclosure vulnerability due to the inclusion of functionality from an untrusted control sphere, allowing an unauthorized attacker to disclose information over a network. Affected versions include .NET 8.0.0 to 8.0.29, .NET 9.0.0 to 9.0.18, Visual Studio 2022 version 17.14.0 to 17.14.37, and Visual Studio 2026 version 18.0 to 18.8.2. An attacker can exploit this vulnerability over a network.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:50:14.890Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-62902"}]}}