{"uuid": "54599bfe-dba1-4e37-b7fa-14ca5a747c57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-62902", "type": "seen", "source": "https://gist.github.com/alon710/2e0b87d1a38ef4ec24f86d5409697e37", "content": "# CVE-2026-62902: CVE-2026-62902: .NET and Visual Studio Information Disclosure Vulnerability\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-11\n> **Full Report:** https://cvereports.com/reports/CVE-2026-62902\n\n## Summary\nAn information disclosure vulnerability in Microsoft .NET and Microsoft Visual Studio allows an unauthorized remote attacker to trigger outbound network requests (SSRF) and disclose sensitive environment data by leveraging untrusted inputs and user interaction.\n\n## TL;DR\nMicrosoft .NET and Visual Studio fail to restrict the resolution of external resources, enabling remote attackers to leak sensitive credentials and internal metadata via crafted files and Server-Side Request Forgery.\n\n## Technical Details\n\n- **CWE ID**: CWE-829, CWE-693, CWE-918\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: Required (UI:R)\n- **CVSS v3.1 Score**: 6.5 (Medium)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 8.0\n- Microsoft .NET 9.0\n- Microsoft .NET 10.0\n- Microsoft Visual Studio 2022 version 17.14\n- Microsoft Visual Studio 2026 version 18.8\n- **Microsoft .NET 8.0**: 8.0.0 to < 8.0.30 (Fixed in: `8.0.30`)\n- **Microsoft .NET 9.0**: 9.0.0 to < 9.0.19 (Fixed in: `9.0.19`)\n- **Microsoft .NET 10.0**: 10.0.0 to < 10.0.11 (Fixed in: `10.0.11`)\n- **Microsoft Visual Studio 2022 version 17.14**: 17.14.0 to < 17.14.38 (Fixed in: `17.14.38`)\n- **Microsoft Visual Studio 2026 version 18.8**: 18.0 to < 18.8.3 (Fixed in: `18.8.3`)\n\n## Mitigation\n\n- Apply the August 2026 security updates for .NET and Visual Studio.\n- Block outbound SMB (ports 139 and 445) to prevent NTLM credential harvesting.\n- Enforce outbound network filtering to restrict servers and development workstations from accessing unapproved external domains.\n\n**Remediation Steps:**\n1. Upgrade .NET 8.0 instances to version 8.0.30 or higher.\n2. Upgrade .NET 9.0 instances to version 9.0.19 or higher.\n3. Upgrade .NET 10.0 instances to version 10.0.11 or higher.\n4. Update Visual Studio 2022 to version 17.14.38 or higher and Visual Studio 2026 to version 18.8.3 or higher.\n5. Implement network-level blocking of outbound TCP ports 139 and 445.\n\n## References\n\n- [Microsoft MSRC Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62902)\n- [CVE.org Official Record](https://www.cve.org/CVERecord?id=CVE-2026-62902)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-62902) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-11T20:33:00.060110Z"}