-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


   #####################################################
  ##  N C S C ~ B E V E I L I G I N G S A D V I E S  ##
 #####################################################

Titel           : Kwetsbaarheden verholpen in Microsoft Developer Tools
Advisory ID     : NCSC-2026-0285
Versie          : 1.00
Kans            : medium
CVE ID          : CVE-2026-47285, CVE-2026-54981, CVE-2026-58612,
                  CVE-2026-58641, CVE-2026-58650, CVE-2026-59113,
                  CVE-2026-59119, CVE-2026-62871, CVE-2026-62872,
                  CVE-2026-62886, CVE-2026-62897, CVE-2026-62899,
                  CVE-2026-62900, CVE-2026-62901, CVE-2026-62902,
                  CVE-2026-62909, CVE-2026-65675, CVE-2026-65810,
                  CVE-2026-69278, CVE-2026-69306, CVE-2026-69320,
                  CVE-2026-70335, CVE-2026-70336, CVE-2026-70337,
                  CVE-2026-70338, CVE-2026-70354
                  (Details over de kwetsbaarheden kunt u vinden op
                   de Mitre website: https://cve.mitre.org/cve/)
Schade          : high
                  Improper Input Validation
                  Relative Path Traversal
                  Improper Neutralization of Special Elements used in a
                  Command ('Command Injection')
                  Improper Neutralization of Special Elements used in an
                  OS Command ('OS Command Injection')
                  Improper Control of Generation of Code ('Code
                  Injection')
                  Heap-based Buffer Overflow
                  Integer Overflow or Wraparound
                  Improper Removal of Sensitive Information Before
                  Storage or Transfer
                  Uncaught Exception
                  Incorrect Default Permissions
                  Inconsistent Interpretation of HTTP Requests ('HTTP
                  Request/Response Smuggling')
                  Unchecked Input for Loop Condition
                  Not Failing Securely ('Failing Open')
                  Authorization Bypass Through User-Controlled Key
                  Protection Mechanism Failure
                  Out-of-bounds Write
                  Inclusion of Functionality from Untrusted Control
                  Sphere
                  Missing Authorization
                  Incorrect Authorization
                  Server-Side Request Forgery (SSRF)
                  Unchecked Return Value
Uitgiftedatum   : 20260811
Toepassing      : Microsoft .NET 10.0 installed on Linux
                  Microsoft .NET 10.0 installed on Mac OS
                  Microsoft .NET 10.0 installed on Windows
                  Microsoft .NET 8.0 installed on Linux
                  Microsoft .NET 8.0 installed on Mac OS
                  Microsoft .NET 8.0 installed on Windows
                  Microsoft .NET 9.0 installed on Linux
                  Microsoft .NET 9.0 installed on Mac OS
                  Microsoft .NET 9.0 installed on Windows
                  Microsoft Microsoft .NET Framework 3.5 AND
                  4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for
                  32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND
                  4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for
                  x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND
                  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
                  Microsoft Microsoft .NET Framework 3.5 AND
                  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server
                  Core installation)
                  Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 on
                  Windows 10 Version 1809 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 on
                  Windows 10 Version 1809 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 on
                  Windows 10 Version 1809 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 on
                  Windows Server 2019
                  Microsoft Microsoft .NET Framework 3.5 AND 4.7.2 on
                  Windows Server 2019 (Server Core installation)
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 1809 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 1809 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 1809 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 21H2 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 21H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 21H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 22H2 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 22H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows 10 Version 22H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows Server 2019
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows Server 2019 (Server Core installation)
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows Server 2022
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8 on
                  Windows Server 2022 (Server Core installation)
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 10 Version 21H2 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 10 Version 21H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 10 Version 21H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 10 Version 22H2 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 10 Version 22H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 10 Version 22H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 11 Version 23H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 11 Version 23H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 11 Version 24H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 11 Version 24H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 11 Version 25H2 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows 11 Version 25H2 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows Server 2022
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows Server 2022 (Server Core installation)
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows Server 2025
                  Microsoft Microsoft .NET Framework 3.5 AND 4.8.1 on
                  Windows Server 2025 (Server Core installation)
                  Microsoft Microsoft .NET Framework 3.5 on Windows 11
                  Version 26H1 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 on Windows 11
                  version 26H1 for x64-based Systems
                  Microsoft Microsoft .NET Framework 3.5 on Windows
                  Server 2012
                  Microsoft Microsoft .NET Framework 3.5 on Windows
                  Server 2012 (Server Core installation)
                  Microsoft Microsoft .NET Framework 3.5 on Windows
                  Server 2012 R2
                  Microsoft Microsoft .NET Framework 3.5 on Windows
                  Server 2012 R2 (Server Core installation)
                  Microsoft Microsoft .NET Framework
                  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
                  Microsoft Microsoft .NET Framework
                  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 (Server
                  Core installation)
                  Microsoft Microsoft .NET Framework
                  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
                  Microsoft Microsoft .NET Framework
                  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
                  (Server Core installation)
                  Microsoft Microsoft .NET Framework 4.8 on Windows 10
                  Version 1607 for 32-bit Systems
                  Microsoft Microsoft .NET Framework 4.8 on Windows 10
                  Version 1607 for x64-based Systems
                  Microsoft Microsoft .NET Framework 4.8 on Windows
                  Server 2012
                  Microsoft Microsoft .NET Framework 4.8 on Windows
                  Server 2012 (Server Core installation)
                  Microsoft Microsoft .NET Framework 4.8 on Windows
                  Server 2012 R2
                  Microsoft Microsoft .NET Framework 4.8 on Windows
                  Server 2012 R2 (Server Core installation)
                  Microsoft Microsoft .NET Framework 4.8 on Windows
                  Server 2016
                  Microsoft Microsoft .NET Framework 4.8 on Windows
                  Server 2016 (Server Core installation)
                  Microsoft Microsoft .NET Framework 4.8.1 on Windows 11
                  Version 26H1 for ARM64-based Systems
                  Microsoft Microsoft .NET Framework 4.8.1 on Windows 11
                  version 26H1 for x64-based Systems
                  Microsoft Microsoft Visual Studio 2022 version 17.14
                  Microsoft Microsoft Visual Studio 2026 version 18.8
                  Microsoft Microsoft Visual Studio Code CoPilot Chat
                  Extension
                  Microsoft PowerShell 7.4
                  Microsoft PowerShell 7.5
                  Microsoft PowerShell 7.6
                  Microsoft Python extension for Visual Studio Code
                  Microsoft Visual Studio Code
Versie(s)       :
Platform(s)     :

Beschrijving
   Microsoft heeft kwetsbaarheden verholpen in diverse Developer Tools.

    Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit
   te voeren die kunnen leiden tot de categorieën schade zoals benoemd
   in onderstaande tabel.
   Voor succesvol misbruik moet de kwaadwillende het slachtoffer
   misleiden een malafide broncodebestand te importeren en verwerken.
   ```
   Visual Studio Code CoPilot Chat Extension:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-65675 | 7.10 | Omzeilen van beveiligingsmaatregel  |
   |----------------|------|-------------------------------------|
   Microsoft PowerShell Core:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-58612 | 7.40 | Toegang tot gevoelige gegevens      |
   | CVE-2026-70337 | 8.80 | Uitvoeren van willekeurige code     |
   |----------------|------|-------------------------------------|
   GitHub Copilot and Visual Studio Code:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-70335 | 7.80 | Verkrijgen van verhoogde rechten    |
   |----------------|------|-------------------------------------|
   Visual Studio Code:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-58650 | 7.80 | Omzeilen van beveiligingsmaatregel  |
   | CVE-2026-59113 | 8.80 | Uitvoeren van willekeurige code     |
   | CVE-2026-47285 | 6.50 | Toegang tot gevoelige gegevens      |
   | CVE-2026-69320 | 8.80 | Uitvoeren van willekeurige code     |
   | CVE-2026-69278 | 7.80 | Omzeilen van beveiligingsmaatregel  |
   | CVE-2026-69306 | 8.20 | Omzeilen van beveiligingsmaatregel  |
   | CVE-2026-70336 | 8.80 | Uitvoeren van willekeurige code     |
   |----------------|------|-------------------------------------|
   .NET Framework:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-62897 | 7.00 | Uitvoeren van willekeurige code     |
   | CVE-2026-62872 | 8.80 | Verkrijgen van verhoogde rechten    |
   | CVE-2026-65810 | 7.80 | Verkrijgen van verhoogde rechten    |
   |----------------|------|-------------------------------------|
   Microsoft PowerShell:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-59119 | 7.30 | Verkrijgen van verhoogde rechten    |
   | CVE-2026-70338 | 7.80 | Omzeilen van beveiligingsmaatregel  |
   |----------------|------|-------------------------------------|
   .NET:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-62899 | 5.90 | Omzeilen van beveiligingsmaatregel  |
   | CVE-2026-62900 | 5.90 | Toegang tot gevoelige gegevens      |
   | CVE-2026-62901 | 7.50 | Denial-of-Service                   |
   | CVE-2026-62902 | 6.50 | Toegang tot gevoelige gegevens      |
   | CVE-2026-62909 | 7.80 | Verkrijgen van verhoogde rechten    |
   | CVE-2026-58641 | 7.80 | Verkrijgen van verhoogde rechten    |
   | CVE-2026-62871 | 7.80 | Uitvoeren van willekeurige code     |
   | CVE-2026-62886 | 7.80 | Verkrijgen van verhoogde rechten    |
   | CVE-2026-70354 | 7.80 | Uitvoeren van willekeurige code     |
   |----------------|------|-------------------------------------|
   Visual Studio Code - Python extension:
   |----------------|------|-------------------------------------|
   | CVE-ID         | CVSS | Impact                              |
   |----------------|------|-------------------------------------|
   | CVE-2026-54981 | 7.80 | Omzeilen van beveiligingsmaatregel  |
   |----------------|------|-------------------------------------|
   ```

Mogelijke oplossingen
   Microsoft heeft updates beschikbaar gesteld waarmee de beschreven
   kwetsbaarheden worden verholpen. We raden u aan om deze updates te
   installeren. Meer informatie over de kwetsbaarheden, de installatie
   van de updates en eventuele work-arounds vindt u op:
   https://portal.msrc.microsoft.com/en-us/security-guidance

   Referenties:


Vrijwaringsverklaring
   Door gebruik van deze security advisory gaat u akkoord met de
   navolgende voorwaarden. Ondanks dat het NCSC de grootst mogelijke
   zorg heeft betracht bij de samenstelling van dit beveiligingsadvies,
   kan het NCSC niet instaan voor de volledigheid, juistheid of
   (voortdurende) actualiteit van dit beveiligingsadvies. De informatie
   in dit beveiligingsadvies is uitsluitend bedoeld als algemene
   informatie voor professionele partijen. Aan de informatie in dit
   beveiligingsadvies kunnen geen rechten worden ontleend. Het NCSC
   en de Staat zijn niet aansprakelijk voor enige schade ten gevolge
   van het gebruik of de onmogelijkheid van het gebruik van dit
   beveiligingsadvies, waaronder begrepen schade ten gevolge van de
   onjuistheid of onvolledigheid van de informatie in dit
   beveiligingsadvies. Op dit beveiligingsadvies is Nederlands recht
   van toepassing. Alle geschillen in verband met en/of voortvloeiend
   uit dit beveiligingsadvies zullen worden voorgelegd aan de exclusief
   bevoegde rechter te Den Haag. Deze rechtskeuze geldt tevens voor de
   voorzieningenrechter in kort geding.
-----BEGIN PGP SIGNATURE-----

iQGzBAEBCgAdFiEEGSwziqblmmRNtImqgupWoL0ZhGEFAmp7fzUACgkQgupWoL0Z
hGFyTQwAh1ZTdjYSqEas3x9R07/c1xb9C3Wimu86lt3DExVQB5uD4uE3Wdk4l9/q
lW4SLL69yj+M6JOTsjPtrVJigvrhz+eeZm9I3NA6PB4mx5OfLTGP7gjomI8QPDsU
Gunn0xCLQtLf2QEr/O8JMio82vDJxIBSJQPk8xcpPUCOON+XVc+H9LpNNLVsq1vA
PTUhGbz2d3JyZKRzY6OldOKVcF1x7ZMixf2v+WDQAJvp4WUAO9kWpx8MdIkHJ80u
zVD11qApLXgRDGdAc8qKN8xAyBJVnwAtsFgHbVZDvGDbbVWuFuXTjif4bClGUnEt
c5vE/f4lWM18hHWnd4NgWbyHKZ3vqsXWP5tNVIwhRDAU6aMNj3iMqCbBt2g5Xo6i
RC2flGQZNK7XuKa7o00J19zMELbzHmsW8qUrfXp5qjI77BFNQttrK8/JFZqWmirT
7/tgn/dpaGkEs1sq2e4xp+iIbhyyaqlSz7N1vpZocJtYBwZp9IAYFfXTAfNHGn5C
NMXFRC9u
=yxIz
-----END PGP SIGNATURE-----