Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Developer Tools.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Omzeilen van een beveiligingsmaatregel
- Uitvoeren van willekeurige code (gebruikersrechten)
- Toegang tot gevoelige gegevens
De kwetsbaarheid met kenmerk CVE-2026-42826 is centraal verholpen door Microsoft en slechts toegevoegd ter informatie. Er zijn hiervoor geen verdere acties benodigd.
```
Azure DevOps:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-42826 | 10.00 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|
Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-41610 | 6.30 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-41611 | 7.80 | Uitvoeren van willekeurige code |
| CVE-2026-41612 | 5.50 | Toegang tot gevoelige gegevens |
| CVE-2026-41613 | 8.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Microsoft Data Formulator:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-41094 | 8.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
ASP.NET Core:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-42899 | 7.50 | Denial-of-Service |
|----------------|------|-------------------------------------|
.NET:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-32177 | 7.30 | Denial-of-Service |
| CVE-2026-35433 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-32175 | 4.30 | <Vertaal: Tampering> |
|----------------|------|-------------------------------------|
GitHub Copilot and Visual Studio:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-41109 | 8.80 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 11
-
Critical 10.0CVE-2026-42826 Public exploit
Azure DevOps Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft Data Formulator Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
-
High 8.8
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.8
Visual Studio Code Elevation of Privilege Vulnerability
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
-
High 7.8
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of script-related html tags in a web page (basic xss) in Visual Studio Code allows an unauthorized attacker to execute code locally.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
-
Medium 6.3
Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
Medium 5.5
Visual Studio Code Information Disclosure Vulnerability
Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.
-
Medium 4.3
.NET Core Tampering Vulnerability
A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could write arbitrary files and directories to certain locations on a vulnerable system. However, an attacker…
Revision history
-
#1.0.0
Initiele versie