CVE-2026-69806: microsoft microsoft visual studio 2022 version 17.14
CVSS: 7.0v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-69806
Published 08-09-2026Last modified 14-10-2026
Vulnerability summary
CVE-2026-69806 is a high (CVSS 7.0) vulnerability in microsoft microsoft visual studio 2022 version 17.14. EPSS estimates a 0.76% chance of exploitation in the next 30 days, higher than 54.3% of scored vulnerabilities.
CVSS score
7.0/10
010
High · v3.1 (CVE.org)EPSS score
0.76%
0%100%
Low · -1.06 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 8 · Related 1Timeline
- 08-09-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
CVSS metrics
3 scores · 3 sources · 1 versionHigh 7.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.0HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.76%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
-1.06 pp
From 1.82% on 19-09-2026
19-09-202619-10-2026
EPSS score0.76%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Affected systems
Microsoft8 products
- microsoft visual studio 2022 version 17.14≥ 17.14.0, < 17.14.40
- microsoft visual studio 2026 version 18.9≥ 18.9.0, < 18.9.3
- .net≥ 9.0.0, < 9.0.20 | ≥ 10.0.0, < 10.0.12 | 11.0.0:preview1 | 11.0.0:preview2 | 11.0.0:preview3 | 11.0.0:preview4 | 11.0.0:preview5 | 11.0.0:preview7
- .net 10.0≥ 10.0.0, < 10.0.12
- .net 11.0≥ 11.0.0, < 11.0 RC1
Ubuntu3 products
- dotnet10< 10.0.112-10.0.12-0ubuntu1~24.04.1 | < 10.0.112-10.0.12-0ubuntu1~26.04.1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
2 vendors · 11 products
