The vendor has published a fix. Version details are below where the sources state them.
Steps
Written by AI from the record
Check whether your systems use the affected .NET and/or Microsoft Visual Studio components, and whether they are on versions earlier than the fixed releases.
Upgrade .NET to version 8.0.30 (and also to 9.0.19 or 10.0.11 if you use those lines).
Upgrade Visual Studio 2022 to 17.14.38 (and Visual Studio 2026 to 18.8.3).
If you can’t upgrade immediately, restrict network access to any services using the vulnerable .NET component until patching is complete.
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network.
In plain language
Written by AI from the record
This is a .NET flaw that can let an attacker over the network view sensitive private data, and most small businesses using the affected .NET/Visual Studio components should take action to upgrade.
CVE-2026-62900 is an information disclosure weakness (CWE-212) in .NET that allows an unauthenticated, network-reachable attacker to steal sensitive data intended for the target system by triggering improper handling/removal of sensitive information before storage or transfer.
If you're affected
Sensitive data disclosure
Customer or employee privacy loss
Credential or secrets exposure
Reputational and legal risk
What is it
Imagine your application is passing along private information, but .NET accidentally leaves that information where it shouldn’t. If an attacker can reach the service over the network, they may be able to view that secret information intended only for your system. This is like leaving a confidential document where a visitor can read it through the window.
Who is affected
This matters if your business runs apps or development environments built on .NET (including Visual Studio 2022 or Visual Studio 2026) and you have a vulnerable .NET component in use. The risk is network-based and does not require an attacker to log in, and it’s reachable in default configurations. Act now if the vulnerable component is reachable over the network; otherwise the exposure is limited.
How urgent is it
This should be treated as urgent because the issue is a network-reachable information leak that does not require an attacker login. Even though there’s no confirmed public exploit code and no KEV listing, the fixed versions are already available and recent patch activity indicates active attention. With a RED verdict, upgrade promptly to eliminate the chance of data exposure.
What to do — in detail
Confirm whether you’re affected
Identify where the vulnerable code is running:
Production servers hosting your .NET apps (the running runtime matters).
Any environments where Visual Studio 2022/2026 is used to build/test apps (depending on your workflow, but patching dev tools is still important).
Check installed versions:
For Visual Studio: confirm your exact Visual Studio 2022 version and whether it matches 17.14 and your patch level is below 17.14.38; confirm Visual Studio 2026 version and whether it matches 18.8 and your patch level is below 18.8.3.
For .NET runtime/framework: confirm which line you use (.NET 8.0, .NET 9.0, .NET 10.0) and whether it is below the fixed patch levels.
Upgrade to the fixed versions
Visual Studio 2022: update to 17.14.38
Visual Studio 2026: update to 18.8.3
.NET 8.0: update to 8.0.30
.NET 9.0: update to 9.0.19
.NET 10.0: update to 10.0.11
If you can’t patch right away (temporary containment)
Reduce network exposure:
Restrict inbound access (firewalls/security groups) so only required clients can reach the service that uses the vulnerable .NET component.
If your architecture allows it, limit which endpoints are publicly reachable while upgrading is in progress.
Keep an eye on access logs/web server logs for unusual requests reaching the vulnerable service.
What to monitor after patching
Application/server logs for errors or abnormal traffic patterns around the time of upgrade.
Any security tooling alerts related to information disclosure attempts.
Timing note
No KEV listing was provided, and there’s no clear dated press claim of exploitation in the findings. However, because the verdict is RED and the vulnerability is network-reachable, prioritize upgrading as soon as possible.
Technical context
CVE-2026-62900 is an information disclosure issue (CWE-212) in .NET caused by improper handling that fails to remove sensitive information before storage or transfer. The findings indicate:
Attack characteristics: network-based, no authentication required, and no user interaction.
Reachability: reachable in default configuration when the vulnerable .NET component is used.
Impact: an attacker can view sensitive or private data intended only for the target system.
Exploitation context: no KEV entry was listed and no public exploit code was found in the provided findings; there is patch-related attention (including reporting that an actor associated with Lazarus group was involved with patch attention), but the findings do not provide a dated exploitation claim.
Patch availability: fixed versions are available for Visual Studio 2022 (17.14.38) and Visual Studio 2026 (18.8.3), and for .NET runtime lines (.NET 8.0: 8.0.30; .NET 9.0: 9.0.19; .NET 10.0: 10.0.11).
EPSS: a prediction was provided (trend flat), but since exploitation confirmation via KEV/news was not provided in the findings, the operational priority is driven by the RED verdict and the network/unauthenticated exposure characteristics.
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
