Summary
Microsoft heeft kwetsbaarheden verholpen in diverse componenten van de Developer Tools, zoals .NET en Visual Studio.
Details
Interpretaties
Een kwaadwillende kan aanvallen uitvoeren die kunnen leiden tot de categoriën schade zoals weergegeven in de onderstaande tabellen.
.NET:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-58280 | 7.50 | Denial-of-Service |
| CVE-2026-66822 | 5.90 | Toegang tot gevoelige gegevens |
| CVE-2026-69651 | 7.50 | Denial-of-Service |
| CVE-2026-70161 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-70165 | 6.70 | Verkrijgen van verhoogde rechten |
| CVE-2026-70174 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70190 | 7.30 | Verkrijgen van verhoogde rechten |
| CVE-2026-70197 | 8.10 | Uitvoeren van willekeurige code |
| CVE-2026-83520 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-84008 | 7.50 | Denial-of-Service |
| CVE-2026-87697 | 8.80 | Uitvoeren van willekeurige code, <Vertaal: > |
| CVE-2026-96224 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-96225 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-96229 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-96231 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-96232 | 7.50 | Toegang tot gevoelige gegevens |
| CVE-2026-96234 | 5.30 | Toegang tot gevoelige gegevens |
| CVE-2026-96235 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-96237 | 7.50 | Uitvoeren van willekeurige code |
| CVE-2026-96238 | 6.50 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-96957 | 8.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-96958 | 7.50 | Denial-of-Service |
| CVE-2026-96959 | 7.50 | Denial-of-Service |
| CVE-2026-96960 | 7.50 | Denial-of-Service |
|------------------|------|-------------------------------------|
Visual Studio Code:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102229 | 6.80 | Toegang tot gevoelige gegevens |
| CVE-2026-102230 | 7.40 | Toegang tot gevoelige gegevens |
| CVE-2026-102231 | 7.70 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102232 | 7.00 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102233 | 7.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102234 | 7.40 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-102235 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-102238 | 9.60 | Uitvoeren van willekeurige code |
| CVE-2026-102851 | 6.10 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-69370 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70098 | 8.80 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|
ASP.NET Core:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102870 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70159 | 7.50 | Denial-of-Service |
| CVE-2026-70175 | 8.10 | Verkrijgen van verhoogde rechten |
| CVE-2026-70179 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-70181 | 7.50 | Denial-of-Service |
| CVE-2026-70183 | 7.50 | Verkrijgen van verhoogde rechten |
| CVE-2026-70186 | 7.50 | Denial-of-Service |
| CVE-2026-70188 | 9.10 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-70196 | 5.90 | Denial-of-Service |
| CVE-2026-88092 | 9.40 | <Vertaal: Tampering> |
| CVE-2026-96230 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-96233 | 7.50 | Denial-of-Service |
| CVE-2026-96236 | 7.50 | Denial-of-Service |
|------------------|------|-------------------------------------|
Visual Studio Tools for Applications and SQL Server Management Studio:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-103572 | 8.80 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|
Windows AppX Deployment Extensions:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-69945 | 8.80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
.NET Framework:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-108398 | 8.80 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-70007 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70035 | 8.80 | Uitvoeren van willekeurige code |
| CVE-2026-70194 | 6.50 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-85363 | 8.80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
Windows AppX Deployment Service:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-69905 | 5.50 | <Vertaal: Tampering> |
| CVE-2026-69914 | 5.50 | Toegang tot gevoelige gegevens |
| CVE-2026-69969 | 4.70 | Toegang tot gevoelige gegevens |
| CVE-2026-69979 | 5.50 | Omzeilen van beveiligingsmaatregel |
| CVE-2026-85849 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-85934 | 7.00 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|
.NET and Visual Studio:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102869 | 8.80 | Verkrijgen van verhoogde rechten, <Vertaal: > |
|------------------|------|-------------------------------------|
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 61
-
Critical 9.6
Visual Studio Code Remote Code Execution Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
Critical 9.4
ASP.NET Core Tampering Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
-
Critical 9.1
ASP.NET Core Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET and Visual Studio Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
ASP.NET Core Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 8.8
Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Security Feature Bypass Vulnerability
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 8.8
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
-
High 8.8
.NET Framework Remote Code Execution Vulnerability
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Framework Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8CVE-2026-96230 Public exploit
ASP.NET Core Remote Code Execution Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET Security Feature Bypass Vulnerability
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.1
ASP.NET Core Elevation of Privilege Vulnerability
Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
-
High 8.1
.NET and Visual Studio Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.8
Visual Studio Code Security Feature Bypass Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
Windows AppX Deployment Service Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.7
Visual Studio Code Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.5
.NET Denial of Service Vulnerability
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Information Disclosure Vulnerability
Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Remote Code Execution Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.5
.NET Denial of Service Vulnerability
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
-
High 7.4
Visual Studio Code Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.0
Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.0
Windows AppX Deployment Service Elevation of Privilege Vulnerability
Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
-
Medium 6.8
Visual Studio Code Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclose information over a network.
-
Medium 6.7
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
.NET Framework Security Feature Bypass Vulnerability
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 6.5
.NET Information Disclosure Vulnerability
Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
.NET Security Feature Bypass Vulnerability
Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 6.1
Visual Studio Code Security Feature Bypass Vulnerability
Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally.
-
Medium 5.9
.NET Information Disclosure Vulnerability
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
-
Medium 5.9
ASP.NET Core Denial of Service Vulnerability
Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
Medium 5.5
Windows AppX Deployment Service Tampering Vulnerability
Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.
-
Medium 5.5
Windows AppX Deployment Service Information Disclosure Vulnerability
Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
-
Medium 5.5
Windows AppX Deployment Service Security Feature Bypass Vulnerability
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.
-
Medium 5.3
.NET Information Disclosure Vulnerability
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
-
Medium 4.7
Windows AppX Deployment Service Information Disclosure Vulnerability
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally.
Revision history
-
#1.0.0
Initiele versie