NCSC | Security Advisories
Bekijk RSS-feed

Security Advisories

Download

Security Advisory; NCSC-2026-0426 [1.0.0]

Security Advisory
NCSC-2026-0426 [1.0.0]
Publicatie
13-10-2026 20:56 (Europe/Amsterdam)
Prioriteit
Normaal
Betreft
Kwetsbaarheden verholpen in Microsoft Developer Tools

Kenmerken

  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • Improper Resolution of Path Equivalence
  • Improper Link Resolution Before File Access ('Link Following')
  • Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Improper Control of Generation of Code ('Code Injection')
  • Improper Encoding or Escaping of Output
  • Out-of-bounds Read
  • Permissive List of Allowed Inputs
  • Integer Overflow or Wraparound
  • Insertion of Sensitive Information Into Sent Data
  • Incorrect Privilege Assignment
  • Authentication Bypass by Spoofing
  • Improper Certificate Validation
  • Origin Validation Error
  • Improper Verification of Cryptographic Signature
  • Improperly Implemented Security Check for Standard
  • Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • Asymmetric Resource Consumption (Amplification)
  • Inefficient Algorithmic Complexity
  • Use After Free
  • Improper Protection of Alternate Path
  • Untrusted Search Path
  • Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
  • Deserialization of Untrusted Data
  • Uncontrolled Recursion
  • Allocation of Resources Without Limits or Throttling
  • Out-of-bounds Write
  • Reliance on Untrusted Inputs in a Security Decision
  • Inclusion of Functionality from Untrusted Control Sphere
  • Deadlock
  • Access of Resource Using Incompatible Type ('Type Confusion')
  • Missing Authorization
  • Incorrect Authorization

Omschrijving

Microsoft heeft kwetsbaarheden verholpen in diverse componenten van de Developer Tools, zoals .NET en Visual Studio.

Een kwaadwillende kan aanvallen uitvoeren die kunnen leiden tot de categoriën schade zoals weergegeven in de onderstaande tabellen.

.NET: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-58280 7.50 Denial-of-Service
CVE-2026-66822 5.90 Toegang tot gevoelige gegevens
CVE-2026-69651 7.50 Denial-of-Service
CVE-2026-70161 7.30 Verkrijgen van verhoogde rechten
CVE-2026-70165 6.70 Verkrijgen van verhoogde rechten
CVE-2026-70174 8.80 Uitvoeren van willekeurige code
CVE-2026-70190 7.30 Verkrijgen van verhoogde rechten
CVE-2026-70197 8.10 Uitvoeren van willekeurige code
CVE-2026-83520 8.80 Uitvoeren van willekeurige code
CVE-2026-84008 7.50 Denial-of-Service
CVE-2026-87697 8.80 Uitvoeren van willekeurige code, <Vertaal: >
CVE-2026-96224 8.80 Uitvoeren van willekeurige code
CVE-2026-96225 7.80 Verkrijgen van verhoogde rechten
CVE-2026-96229 6.50 Toegang tot gevoelige gegevens
CVE-2026-96231 7.80 Verkrijgen van verhoogde rechten
CVE-2026-96232 7.50 Toegang tot gevoelige gegevens
CVE-2026-96234 5.30 Toegang tot gevoelige gegevens
CVE-2026-96235 8.80 Uitvoeren van willekeurige code
CVE-2026-96237 7.50 Uitvoeren van willekeurige code
CVE-2026-96238 6.50 Omzeilen van beveiligingsmaatregel
CVE-2026-96957 8.80 Omzeilen van beveiligingsmaatregel
CVE-2026-96958 7.50 Denial-of-Service
CVE-2026-96959 7.50 Denial-of-Service
CVE-2026-96960 7.50 Denial-of-Service
------------------ ------ -------------------------------------

Visual Studio Code: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-102229 6.80 Toegang tot gevoelige gegevens
CVE-2026-102230 7.40 Toegang tot gevoelige gegevens
CVE-2026-102231 7.70 Omzeilen van beveiligingsmaatregel
CVE-2026-102232 7.00 Omzeilen van beveiligingsmaatregel
CVE-2026-102233 7.80 Omzeilen van beveiligingsmaatregel
CVE-2026-102234 7.40 Omzeilen van beveiligingsmaatregel
CVE-2026-102235 8.80 Uitvoeren van willekeurige code
CVE-2026-102238 9.60 Uitvoeren van willekeurige code
CVE-2026-102851 6.10 Omzeilen van beveiligingsmaatregel
CVE-2026-69370 8.80 Uitvoeren van willekeurige code
CVE-2026-70098 8.80 Uitvoeren van willekeurige code
------------------ ------ -------------------------------------

ASP.NET Core: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-102870 8.80 Uitvoeren van willekeurige code
CVE-2026-70159 7.50 Denial-of-Service
CVE-2026-70175 8.10 Verkrijgen van verhoogde rechten
CVE-2026-70179 7.50 Verkrijgen van verhoogde rechten
CVE-2026-70181 7.50 Denial-of-Service
CVE-2026-70183 7.50 Verkrijgen van verhoogde rechten
CVE-2026-70186 7.50 Denial-of-Service
CVE-2026-70188 9.10 Omzeilen van beveiligingsmaatregel
CVE-2026-70196 5.90 Denial-of-Service
CVE-2026-88092 9.40 <Vertaal: Tampering>
CVE-2026-96230 8.80 Uitvoeren van willekeurige code
CVE-2026-96233 7.50 Denial-of-Service
CVE-2026-96236 7.50 Denial-of-Service
------------------ ------ -------------------------------------

Visual Studio Tools for Applications and SQL Server Management Studio: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-103572 8.80 Uitvoeren van willekeurige code
------------------ ------ -------------------------------------

Windows AppX Deployment Extensions: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-69945 8.80 Verkrijgen van verhoogde rechten
------------------ ------ -------------------------------------

.NET Framework: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-108398 8.80 Omzeilen van beveiligingsmaatregel
CVE-2026-70007 8.80 Uitvoeren van willekeurige code
CVE-2026-70035 8.80 Uitvoeren van willekeurige code
CVE-2026-70194 6.50 Omzeilen van beveiligingsmaatregel
CVE-2026-85363 8.80 Verkrijgen van verhoogde rechten
------------------ ------ -------------------------------------

Windows AppX Deployment Service: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-69905 5.50 <Vertaal: Tampering>
CVE-2026-69914 5.50 Toegang tot gevoelige gegevens
CVE-2026-69969 4.70 Toegang tot gevoelige gegevens
CVE-2026-69979 5.50 Omzeilen van beveiligingsmaatregel
CVE-2026-85849 7.80 Verkrijgen van verhoogde rechten
CVE-2026-85934 7.00 Verkrijgen van verhoogde rechten
------------------ ------ -------------------------------------

.NET and Visual Studio: |------------------|------|-------------------------------------|

CVE-ID CVSS Impact
CVE-2026-102869 8.80 Verkrijgen van verhoogde rechten, <Vertaal: >
------------------ ------ -------------------------------------

Oplossingen

Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

CVE's

Producten

Microsoft
.NET 10.0 installed on Linux
.NET 10.0 installed on Mac OS
.NET 10.0 installed on Windows
.NET 11.0 installed on Linux
.NET 11.0 installed on Mac OS
.NET 11.0 installed on Windows
.NET 8.0 installed on Linux
.NET 8.0 installed on Mac OS
.NET 8.0 installed on Windows
.NET 9.0 installed on Linux
.NET 9.0 installed on Mac OS
.NET 9.0 installed on Windows
ASP.NET Core 10.0
ASP.NET Core 11.0
ASP.NET Core 8.0
ASP.NET Core 9.0
Azure API Center
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
Microsoft .NET Framework 4.8
Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1
Microsoft Visual Studio 2022 version 17.14
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Linux
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Mac OS
Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Windows
System.Security.Cryptography.Xml on .NET 10.0 installed on Linux
System.Security.Cryptography.Xml on .NET 10.0 installed on Mac OS
System.Security.Cryptography.Xml on .NET 10.0 installed on Windows
System.Security.Cryptography.Xml on .NET 11.0 installed on Linux
System.Security.Cryptography.Xml on .NET 11.0 installed on Mac OS
System.Security.Cryptography.Xml on .NET 11.0 installed on Windows
System.Security.Cryptography.Xml on .NET 9.0 installed on Linux
System.Security.Cryptography.Xml on .NET 9.0 installed on Mac OS
System.Security.Cryptography.Xml on .NET 9.0 installed on Windows
Visual Studio Code

Disclaimer

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.