Microsoft Entwicklerwerkzeuge: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Summary

Product

Vulnerabilities 22

• Critical 9.6
  CVE-2026-81376

  Visual Studio Code Security Feature Bypass Vulnerability

  Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 8.8
  CVE-2026-69439

  .NET and Visual Studio Elevation of Privilege Vulnerability

  Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine NuGet
  Sep 8, 2026
• High 8.8
  CVE-2026-69522

  .NET and Visual Studio Remote Code Execution Vulnerability

  Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet
  Sep 8, 2026
• High 8.8
  CVE-2026-71328

  .NET and Visual Studio Remote Code Execution Vulnerability

  Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine NuGet
  Sep 8, 2026
• High 8.8
  CVE-2026-77906

  Visual Studio Remote Code Execution Vulnerability

  Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2026 version 18.9
  Sep 8, 2026
• High 8.8
  CVE-2026-77907

  Visual Studio Remote Code Execution Vulnerability

  Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2026 version 18.9
  Sep 8, 2026
• High 8.8
  CVE-2026-78462

  Visual Studio Code Security Feature Bypass Vulnerability

  Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 8.2
  CVE-2026-81356

  Visual Studio Code Security Feature Bypass Vulnerability

  Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 8.2
  CVE-2026-81357

  Visual Studio Code Security Feature Bypass Vulnerability

  Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 8.2
  CVE-2026-81378

  Visual Studio Code Security Feature Bypass Vulnerability

  Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 8.2
  CVE-2026-81379

  Visual Studio Code Security Feature Bypass Vulnerability

  Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 7.8
  CVE-2026-70334

  Visual Studio Code Security Feature Bypass Vulnerability

  Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 7.5
  CVE-2026-57099

  ASP.NET Core Denial of Service Vulnerability

  Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft AspNetCore.OData
  Sep 8, 2026
• High 7.5
  CVE-2026-69805

  .NET Elevation of Privilege Vulnerability

  External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.9 Microsoft.Diagnostics.Runtime
  Sep 8, 2026
• High 7.4
  CVE-2026-78461

  Visual Studio Code Security Feature Bypass Vulnerability

  Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 7.4
  CVE-2026-81383

  Visual Studio Code Information Disclosure Vulnerability

  Use of incorrectly-resolved name or reference in Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• High 7.0
  CVE-2026-69806

  .NET Elevation of Privilege Vulnerability

  Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine
  Sep 8, 2026
• Medium 6.5
  CVE-2026-58649

  .NET Information Disclosure Vulnerability

  Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine
  Sep 8, 2026
• Medium 6.5
  CVE-2026-81377

  Visual Studio Code Tampering Vulnerability

  Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• Medium 6.5
  CVE-2026-81381

  GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

  Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026
• Medium 5.9
  CVE-2026-69304

  ASP.NET Core Denial of Service Vulnerability

  Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Sep 8, 2026
• Medium 5.3
  CVE-2026-81380

  GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability

  Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  Microsoft Visual Studio Code
  Sep 8, 2026

Revision history

1. 2026-10-06 #9

   Neue Updates von Red Hat aufgenommen

2. 2026-10-04 #8

   Neue Updates von Red Hat aufgenommen

3. 2026-09-20 #7

   Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

4. 2026-09-17 #6

   Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

5. 2026-09-16 #5

   Neue Updates von Oracle Linux, Rocky Enterprise Software Foundation und Red Hat aufgenommen

6. 2026-09-15 #4

   Neue Updates von Oracle Linux und Red Hat aufgenommen

7. 2026-09-14 #3

   Neue Updates von Fedora aufgenommen

8. 2026-09-09 #2

   Neue Updates von Ubuntu aufgenommen

9. 2026-09-08 #1

   Initiale Fassung

References

• Microsoft Leitfaden für Sicherheitsupdates
  https://msrc.microsoft.com/update-guide/
• Microsoft Security Advisory CVE-2026-34182
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34182
• Microsoft Security Advisory CVE-2025-70873
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-70873
• Microsoft Security Advisory CVE-2026-70334
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70334
• Microsoft Security Advisory CVE-2026-78461
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78461
• Microsoft Security Advisory CVE-2026-81357
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81357
• Microsoft Security Advisory CVE-2026-81356
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81356
• Microsoft Security Advisory CVE-2026-81381
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81381
• Microsoft Security Advisory CVE-2026-81380
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81380
• Microsoft Security Advisory CVE-2026-78462
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-78462
• Microsoft Security Advisory CVE-2026-81379
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81379
• Microsoft Security Advisory CVE-2026-81378
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81378
• Microsoft Security Advisory CVE-2026-81377
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81377
• Microsoft Security Advisory CVE-2026-81376
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81376
• Microsoft Security Advisory CVE-2026-81383
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81383
• Microsoft Security Advisory CVE-2026-69522
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69522
• Microsoft Security Advisory CVE-2026-69304
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69304
• Microsoft Security Advisory CVE-2026-71328
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-71328
• Microsoft Security Advisory CVE-2026-58649
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58649
• Microsoft Security Advisory CVE-2026-69439
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69439
• Microsoft Security Advisory CVE-2026-69806
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69806
• Microsoft Security Advisory CVE-2026-69805
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69805
• Microsoft Security Advisory CVE-2026-57099
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57099
• Microsoft Security Advisory CVE-2026-77906
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77906
• Microsoft Security Advisory CVE-2026-77907
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77907
• Ubuntu Security Notice USN-8740-1 vom 2026-09-10
  https://ubuntu.com/security/notices/USN-8740-1
• Fedora Security Advisory FEDORA-2026-D757A4044B vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-d757a4044b
• Fedora Security Advisory FEDORA-2026-0FA8C76E88 vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-0fa8c76e88
• Fedora Security Advisory FEDORA-2026-04A0116777 vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-04a0116777
• Fedora Security Advisory FEDORA-2026-182712D480 vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-182712d480
• Fedora Security Advisory FEDORA-2026-9D80C37C0A vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-9d80c37c0a
• Fedora Security Advisory FEDORA-2026-A5C27E8727 vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-a5c27e8727
• Fedora Security Advisory FEDORA-2026-FA6DE37202 vom 2026-09-14
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-fa6de37202
• Red Hat Security Advisory RHSA-2026:67525 vom 2026-09-15
  https://access.redhat.com/errata/RHSA-2026:67525
• Red Hat Security Advisory RHSA-2026:67524 vom 2026-09-15
  https://access.redhat.com/errata/RHSA-2026:67524
• Oracle Linux Security Advisory ELSA-2026-67525 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67525.html
• Red Hat Security Advisory RHSA-2026:67614 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:67614
• Red Hat Security Advisory RHSA-2026:67528 vom 2026-09-15
  https://access.redhat.com/errata/RHSA-2026:67528
• Oracle Linux Security Advisory ELSA-2026-67528 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67528.html
• Red Hat Security Advisory RHSA-2026:67613 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:67613
• Red Hat Security Advisory RHSA-2026:67530 vom 2026-09-15
  https://access.redhat.com/errata/RHSA-2026:67530
• Oracle Linux Security Advisory ELSA-2026-67530 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67530.html
• Oracle Linux Security Advisory ELSA-2026-67524 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67524.html
• Rocky Linux Security Advisory RLSA-2026:67614 vom 2026-09-16
  https://errata.build.resf.org/RLSA-2026:67614
• Oracle Linux Security Advisory ELSA-2026-67613 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67613.html
• Red Hat Security Advisory RHSA-2026:68316 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68316
• Rocky Linux Security Advisory RLSA-2026:67524 vom 2026-09-16
  https://errata.build.resf.org/RLSA-2026:67524
• Rocky Linux Security Advisory RLSA-2026:67525 vom 2026-09-16
  https://errata.build.resf.org/RLSA-2026:67525
• Rocky Linux Security Advisory RLSA-2026:67528 vom 2026-09-16
  https://errata.build.resf.org/RLSA-2026:67528
• Red Hat Security Advisory RHSA-2026:68233 vom 2026-09-16
  https://access.redhat.com/errata/RHSA-2026:68233
• Oracle Linux Security Advisory ELSA-2026-67614 vom 2026-09-16
  https://linux.oracle.com/errata/ELSA-2026-67614.html
• Rocky Linux Security Advisory RLSA-2026:67530 vom 2026-09-16
  https://errata.build.resf.org/RLSA-2026:67530
• Rocky Linux Security Advisory RLSA-2026:67613 vom 2026-09-16
  https://errata.build.resf.org/RLSA-2026:67613
• Rocky Linux Security Advisory RLSA-2026:68233 vom 2026-09-17
  https://errata.build.resf.org/RLSA-2026:68233
• Red Hat Security Advisory RHSA-2026:68676 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68676
• Rocky Linux Security Advisory RLSA-2026:68316 vom 2026-09-17
  https://errata.build.resf.org/RLSA-2026:68316
• Oracle Linux Security Advisory ELSA-2026-68233 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68233.html
• Oracle Linux Security Advisory ELSA-2026-68316 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68316.html
• Oracle Linux Security Advisory ELSA-2026-68676 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68676.html
• Rocky Linux Security Advisory RLSA-2026:68676 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68676
• Red Hat Security Advisory RHSA-2026:74947 vom 2026-10-02
  https://access.redhat.com/errata/RHSA-2026:74947
• Red Hat Security Advisory RHSA-2026:74950 vom 2026-10-02
  https://access.redhat.com/errata/RHSA-2026:74950
• Red Hat Security Advisory RHSA-2026:76978 vom 2026-10-07
  https://access.redhat.com/errata/RHSA-2026:76978
• Red Hat Security Advisory RHSA-2026:77004 vom 2026-10-07
  https://access.redhat.com/errata/RHSA-2026:77004