CVE-2026-62902

.NET Information Disclosure Vulnerability

No known exploitation. EPSS puts it in the 57th percentile. A vendor fix is available.

CVSS 3.16.5Medium EPSS percentile57th0.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-14Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which of these you’re running: Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.8.x), and your installed .NET runtime version (8.0.x or 9.0.x).
If you are on Visual Studio 2022, upgrade to 17.14.38 or later.
If you are on Visual Studio 2026, upgrade to 18.8.3 or later.
If you are on .NET 8.0 (8.0.x), upgrade to 8.0.30 or later.
If you are on .NET 9.0 (9.0.x), upgrade to 9.0.19 or later.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

In plain language

Written by AI from the record

CVE-2026-62902 is a .NET/Visual Studio issue that can let an attacker steal confidential data over the network, but it requires your business/user to interact with the affected app and for the app to load untrusted external functionality—still, you should update because it’s a newly reported, high-priority patch.

CVE-2026-62902 is an information disclosure issue in .NET/Visual Studio where untrusted external sources can be incorporated into .NET functionality, enabling remote confidential data disclosure (no authentication; network accessible) after user interaction.

If you're affected

Confidential data theft
Customer or internal data exposure
Account or intellectual property risk
Incident response and downtime costs

What is it

This vulnerability is like a “plug-in” system in .NET that can accidentally accept code from untrusted sources. If that happens and someone interacts with the affected application, an attacker may be able to quietly grab confidential information across the network.

Who is affected

This matters if your organization uses Microsoft .NET (including .NET 8.0 or .NET 9.0) and Visual Studio (2022 or 2026) in a way that can load or incorporate functionality from external, untrusted sources. It’s reachable in the default configuration, but it still requires user interaction before the data can be exposed.

Practical reachability gate: only a risk if your environment/app can incorporate untrusted external functionality and the user interaction step occurs.

How urgent is it

This is RED because it’s a newly reported patch affecting commonly used development/runtime components, and threat-actor activity connected to this patch (Lazarus group) increases the likelihood of real-world targeting. Attackers look for setups where .NET incorporates untrusted external functionality, then rely on the required user interaction to trigger data exposure.

What to do — in detail

Confirm exposure

Inventory what you actually run:
- Visual Studio 2022 version (check the exact 17.14.x build).
- Visual Studio 2026 version (check the exact 18.8.x build).
- Installed .NET runtime versions:
  - .NET 8.0 (8.0.x)
  - .NET 9.0 (9.0.x)
Compare to the fixed versions:
- Visual Studio 2022 → fixed in 17.14.38
- Visual Studio 2026 → fixed in 18.8.3
- .NET → fixed in 8.0.30
- .NET 8.0 → fixed in 8.0.30
- .NET 9.0 → fixed in 9.0.19
Also check your application behavior for the trigger condition described in the findings: does your app incorporate functionality from external, untrusted sources (for example, dynamically loaded/plug-in-like components)?

Patch / upgrade (target versions)

Upgrade Visual Studio 2022 to 17.14.38 (or later in the same 17.14 line).
Upgrade Visual Studio 2026 to 18.8.3 (or later in the same 18.8 line).
Upgrade .NET 8.0 to 8.0.30 (or later).
Upgrade .NET 9.0 to 9.0.19 (or later).

If patching is delayed (temporary risk reduction)

Reduce the chance of “untrusted external functionality” being incorporated: review and restrict any feature/plugin/source-loading paths so only trusted sources/components are used.
Limit exposure paths where an attacker would be able to reach the network-exposed functionality that leads to the disclosure.

What to monitor after updating

Verify your installed versions match the fixed builds.
Watch for unusual data-access patterns or error/activity spikes around the features that load external/untrusted functionality (since user interaction is required, patterns may cluster around specific user actions).

KEV / deadlines

CISA KEV listing: not listed in the provided findings, so no CISA-specific due date was provided here.

Technical context

CVE-2026-62902 is categorized as an information disclosure issue (CWE-693, CWE-829, CWE-918). Mechanism: .NET incorporates functionality from “external, unverified sources” (untrusted control sphere), and that incorporation can allow an attacker to access confidential data over a network.

Key conditions from the findings:

Authentication required: no.
Network reachability: yes in default configuration.
User interaction: required (the victim must interact with the application).
No public exploit code on record (per findings).
KEV status: not listed in CISA KEV (per findings).
Exploitation in the wild (press/news): no clearly dated claim for this specific CVE (per findings).
However, patch-related reporting indicates actor activity tied to this patch (Lazarus group) (per PULSE), which is why urgency is treated as high.

Predicted likelihood (not a guarantee): EPSS is 0.8% with a flat trend (per findings). Because KEV/news did not confirm exploitation for this exact CVE in the provided material, public EPSS values are not used to drive owner-facing decisions.

Fixed versions from the provided patch data:

Visual Studio 2022: 17.14.38
Visual Studio 2026: 18.8.3
.NET 8.0 / .NET: 8.0.30
.NET 9.0: 9.0.19

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS57th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.9% chance of exploitation activity in the next 30 days, which ranks it in the 57th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

9 events over 4 days, from the signal feeds we watch.

2026-08-15OpenVAS check added
2026-08-14Patch availablerecord updated
2026-08-13Record updated
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- visual studio 2022Desktop AppOn-premDevTools & CI / ide-editor
- visual studio 2026Dev ToolOn-premDevTools & CI / ide-editor
- .netLibraryOSS Libraries / generic-library
- .NET 8.0LibraryLibraryOSS Libraries / generic-library
- .NET 9.0LibraryMixedOSS Libraries / generic-library
- Microsoft Visual Studio 2022 version 17.14Dev ToolOn-premDevTools & CI / ide-editor
- Microsoft Visual Studio 2026 version 18.8On-premOperating Systems / windows

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact