Microsoft Visual Studio 2026 vulnerabilities
40 vulnerabilities
Known vulnerabilities in Microsoft Visual Studio 2026, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-96957ubuntudotnet10+9
EPSS score0.45%
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-96222chainguarddotnet-8-sdk+36EPSS score0.58%
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-88092chainguarddotnet-bootstrap-8+28EPSS score0.79%
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.CVE-2026-85790ubuntudotnet7+20EPSS score0.69%
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.CVE-2026-71328ubuntudotnet7+10EPSS score0.76%
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-77906microsoftmicrosoft visual studio 2026 version 18.9+1EPSS score0.82%
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-77907microsoftmicrosoft visual studio 2026 version 18.9+1EPSS score0.82%
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-62871ubuntudotnet7+10EPSS score0.47%
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.CVE-2026-62901chainguarddotnet-bootstrap-8+26EPSS score1.23%
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-62886ubuntudotnet7+19EPSS score0.47%
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.CVE-2026-62902ubuntudotnet7+10EPSS score0.87%
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-62900chainguarddotnet-sdk-10.0.2+15EPSS score0.75%
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.CVE-2026-62897ubuntudotnet7+16EPSS score0.37%
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.CVE-2026-62899chainguarddotnet-bootstrap-8+23EPSS score0.75%
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-62909chainguarddotnet-bootstrap-8+23EPSS score0.26%
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.CVE-2026-62898ubuntudotnet7+11EPSS score1.03%
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.CVE-2026-47305microsoftmicrosoft visual studio 2022 version 17.12+4EPSS score0.47%
Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.CVE-2026-47303ubuntudotnet10+13EPSS score0.84%
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-47300ubuntudotnet10+13EPSS score0.78%
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.CVE-2026-47304chainguardaspnet-8-targeting-pack+42EPSS score0.29%
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.