Skip to content
OpenAdvisories
High NCSC-2026-0351 15 CVEs

Kwetsbaarheden verholpen in Microsoft Developer Tools

Published Sep 8, 2026 · Updated Sep 8, 2026 · nl

Vendor: Microsoft Product: .NET 10.0 installed on Linux Product: .NET 10.0 installed on Mac OS Product: .NET 10.0 installed on Windows Product: .NET 8.0 installed on Linux Product: .NET 8.0 installed on Mac OS Product: .NET 8.0 installed on Windows Product: .NET 9.0 installed on Linux Product: .NET 9.0 installed on Mac OS Product: .NET 9.0 installed on Windows Product: ASP.NET Core 10.0 Product: ASP.NET Core 8.0 Product: Microsoft.AspNetCore.OData Product: Visual Studio Code

Summary

Microsoft heeft 15 kwetsbaarheden verholpen in diverse Developer Tools.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade zoals benoemd in onderstaande tabel.

De ernstigste kwetsbaarheid met kenmerk CVE-2026-81376 heeft een CVSS-score van 9,6. Een kwaadwillende misbruiken door een gebruiker ertoe te verleiden een speciaal geprepareerde Visual Studio Code-workspace te openen. Hiermee kunnen de Workspace Trust-beperkingen worden omzeild, waardoor inhoud uit een niet-vertrouwde workspace opdrachten of code kan uitvoeren zonder dat de gebruiker hiervoor eerst toestemming geeft. Hierdoor kan de kwaadwillende toegang krijgen tot lokale gegevens of code uitvoeren met de rechten van de gebruiker.

Voor succesvol misbruik moet de kwaadwillende het slachtoffer misleiden een malafide broncodebestand te importeren en verwerken.

```
.NET:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-58649 | 6,50 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|

GitHub Copilot and Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-81380 | 5,30 | Toegang tot gevoelige gegevens |
| CVE-2026-81381 | 6,50 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|

Visual Studio Code:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-70334 | 7,80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-78461 | 7,40 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-78462 | 8,80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-81356 | 8,20 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-81357 | 8,20 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-81376 | 9,60 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-81377 | 6,50 | <Vertaal: Tampering> |
| CVE-2026-81378 | 8,20 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-81379 | 8,20 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-81383 | 7,40 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|

ASP.NET Core:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-57099 | 7,50 | Denial-of-Service |
| CVE-2026-69304 | 5,90 | Denial-of-Service |
|----------------|------|-------------------------------------|

------------------- Productgroep Apps ---------------------------------

All CVE's for this product group:
CVE-2026-58611, CVE-2026-80097

Microsoft Authenticator:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-80097 | 8,60 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

XBox Gaming Services:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-58611 | 7,80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

```

Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Vulnerabilities 15

  • Critical 9.6
    CVE-2026-81376

    Visual Studio Code Security Feature Bypass Vulnerability

    Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 8.8
    CVE-2026-78462

    Visual Studio Code Security Feature Bypass Vulnerability

    Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 8.2
    CVE-2026-81356

    Visual Studio Code Security Feature Bypass Vulnerability

    Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 8.2
    CVE-2026-81357

    Visual Studio Code Security Feature Bypass Vulnerability

    Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 8.2
    CVE-2026-81378

    Visual Studio Code Security Feature Bypass Vulnerability

    Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 8.2
    CVE-2026-81379

    Visual Studio Code Security Feature Bypass Vulnerability

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 7.8
    CVE-2026-70334

    Visual Studio Code Security Feature Bypass Vulnerability

    Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

    Microsoft Visual Studio Code
  • High 7.5
    CVE-2026-57099

    ASP.NET Core Denial of Service Vulnerability

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

    Microsoft AspNetCore.OData
  • High 7.4
    CVE-2026-78461

    Visual Studio Code Security Feature Bypass Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

    Microsoft Visual Studio Code
  • High 7.4
    CVE-2026-81383

    Visual Studio Code Information Disclosure Vulnerability

    Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Microsoft Visual Studio Code
  • Medium 6.5
    CVE-2026-58649

    .NET Information Disclosure Vulnerability

    Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine
  • Medium 6.5
    CVE-2026-81377

    Visual Studio Code Tampering Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

    Microsoft Visual Studio Code
  • Medium 6.5
    CVE-2026-81381

    GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Microsoft Visual Studio Code
  • Medium 5.9
    CVE-2026-69304

    ASP.NET Core Denial of Service Vulnerability

    Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

    Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  • Medium 5.3
    CVE-2026-81380

    GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

    Microsoft Visual Studio Code

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://portal.msrc.microsoft.com/en-us/security-guidance