Microsoft Microsoft Visual Studio 2026 version 18.10 vulnerabilities

CVE-2026-109468 High · 7.5 CWE-770 Oct 15, 2026

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-96957 High · 8.8 CWE-347 Oct 13, 2026

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-96238 Medium · 6.5 CWE-346 Oct 13, 2026

.NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-96237 High · 7.5 CWE-829 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-96236 High · 7.5 CWE-770 Oct 13, 2026

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-96235 High · 8.8 CWE-787 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-96234 Medium · 5.3 CWE-346 Oct 13, 2026

.NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

CVE-2026-96232 High · 7.5 CWE-125 Oct 13, 2026

.NET Information Disclosure Vulnerability

Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

CVE-2026-96231 High · 7.8 CWE-59 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-96230 High · 8.8 CWE-79 Oct 13, 2026

ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVE-2026-96229 Medium · 6.5 CWE-183 Oct 13, 2026

.NET Information Disclosure Vulnerability

Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

CVE-2026-96225 High · 7.8 CWE-59 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-96224 High · 8.8 CWE-787 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-96222 High · 7.4 CWE-295 Oct 13, 2026

Active Directory Federation Services (AD FS) Spoofing Vulnerability

Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-88092 Critical · 9.4 CWE-444 Oct 13, 2026

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVE-2026-87697 High · 8.8 CWE-502 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-85790 Medium · 5.9 CWE-416 Oct 13, 2026

Microsoft QUIC Information Disclosure Vulnerability

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

CVE-2026-85363 High · 8.8 CWE-190 Oct 13, 2026

.NET Framework Elevation of Privilege Vulnerability

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-84008 High · 7.5 CWE-407 Oct 13, 2026

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-83520 High · 8.8 CWE-502 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70197 High · 8.1 CWE-787 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70196 Medium · 5.9 CWE-407 Oct 13, 2026

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-70194 Medium · 6.5 CWE-295 Oct 13, 2026

.NET Framework Security Feature Bypass Vulnerability

Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-70190 High · 7.3 CWE-59 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-70188 Critical · 9.1 CWE-444 Oct 13, 2026

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.