CVE-2026-58649

Published: Sep 8, 2026Modified: Oct 7, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

Affected (15)

Products: Microsoft: .net, .net Sdk, Visual Studio 2022, Visual Studio 2026

4 products

Visual Studio 2022

Visual Studio 2026

Configuration A

13 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net	Version 11.0.0 preview1
Microsoft .net	Version 11.0.0 preview2
Microsoft .net	Version 11.0.0 preview3
Microsoft .net	Version 11.0.0 preview4
Microsoft .net	Version 11.0.0 preview5
Microsoft .net	Version 11.0.0 preview6
Microsoft .net	Version 11.0.0 preview7
Microsoft .net Sdk	10.0.100 ≤ version < 10.0.111
Microsoft .net Sdk	10.0.200 ≤ version < 10.0.400
Microsoft .net Sdk	8.0.100 ≤ version < 8.0.130
Microsoft .net Sdk	8.0.200 ≤ version < 8.0.424
Microsoft .net Sdk	9.0.100 ≤ version < 9.0.120
Microsoft .net Sdk	9.0.200 ≤ version < 9.0.317

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Visual Studio 2022	17.14.0 ≤ version < 17.14.40
Microsoft Visual Studio 2026	18.9.0 ≤ version < 18.9.3

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58649

Source: secure@microsoft.com

PatchVendor Advisory

Timeline

No history available yet.