{"id":"CVE-2026-69805","aliases":[],"cve":{"records":[{"id":"CVE-2026-69805","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-03T22:47:19.710Z","published":"2026-09-08T17:17:36.211Z","modified":"2026-10-30T21:55:57.040Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T21:55:57.040Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-09T09:54:54.420Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69805","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-73","description":"CWE-73: External Control of File Name or Path","source":"microsoft"},{"id":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","source":"microsoft"},{"id":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"17.14.0","versionEndExcluding":"17.14.40"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*","versionStartIncluding":"18.9.0","versionEndExcluding":"18.9.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:diagnostics_runtime:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.740301","versionEndExcluding":"4.1.740301"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-09T04:18:29.981672Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":".NET Elevation of Privilege Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.","score":7.5,"severity":"high","published":"2026-09-08T17:17:36.211Z","modified":"2026-10-30T21:55:57.040Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft Visual Studio 2022 version 17.14","platforms":[],"versions":[{"version":"17.14.0","status":"affected","lessThan":"17.14.40","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69805"},{"vendor":"Microsoft","name":"Microsoft Visual Studio 2026 version 18.9","platforms":[],"versions":[{"version":"18.9.0","status":"affected","lessThan":"18.9.3","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69805"},{"vendor":"Microsoft","name":"Microsoft.Diagnostics.Runtime","platforms":[],"versions":[{"version":"4.1.740301","status":"affected","lessThan":"4.1.740301","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69805"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69805"],"sources":[{"name":"CVE","id":"CVE-2026-69805","modified":"2026-10-30T21:55:57.040Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-69805"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-30T22:54:05.634Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T05:25:31.914Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Microsoft .NET products, including Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.9, have an elevation of privilege vulnerability due to external control of file name or path. An attacker with network access may exploit this weakness. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T01:21:01.655Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-69805"}]}}