Microsoft Microsoft Visual Studio 2026 version 18.10 vulnerabilities

CVE-2026-70186 High · 7.5 CWE-833 Oct 13, 2026

ASP.NET Core Denial of Service Vulnerability

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-70183 High · 7.5 CWE-362 Oct 13, 2026

ASP.NET Core Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-70181 High · 7.5 CWE-770 Oct 13, 2026

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-70179 High · 7.5 CWE-290 Oct 13, 2026

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVE-2026-70175 High · 8.1 CWE-640 Oct 13, 2026

ASP.NET Core Elevation of Privilege Vulnerability

Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-70174 High · 8.8 CWE-358 Oct 13, 2026

.NET Remote Code Execution Vulnerability

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

CVE-2026-70165 Medium · 6.7 CWE-59 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-70162 Medium · 5.9 CWE-405 Oct 13, 2026

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

CVE-2026-70161 High · 7.3 CWE-22 Oct 13, 2026

.NET Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.

CVE-2026-70159 High · 7.5 CWE-770 Oct 13, 2026

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVE-2026-70035 High · 8.8 CWE-502 Oct 13, 2026

.NET Framework Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

CVE-2026-70007 High · 8.8 CWE-787 Oct 13, 2026

.NET Framework Remote Code Execution Vulnerability

Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

CVE-2026-69651 High · 7.5 CWE-407 Oct 13, 2026

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-66822 Medium · 5.9 CWE-201 Oct 13, 2026

.NET Information Disclosure Vulnerability

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

CVE-2026-58280 High · 7.5 CWE-674 Oct 13, 2026

.NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-105016 Critical · 9.8 CWE-122 Oct 13, 2026

Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVE-2026-103572 High · 8.8 CWE-94 Oct 13, 2026

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

CVE-2026-102870 High · 8.8 CWE-94 Oct 13, 2026

Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVE-2026-102869 High · 8.8 CWE-843 Oct 13, 2026

.NET and Visual Studio Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.