CVE-2026-50659: .net framework 4.8.1, 4.8, 4.6.2 (+4 more affected versions); +16 more affected products

Affected technology

.net framework · 4.8.1
microsoft

.net framework · 4.8
microsoft

.net framework · 4.6.2
microsoft

.net framework · 4.7
microsoft

.net framework · 4.7.1
microsoft

.net framework · 4.7.2
microsoft

.net · from 8.0.0 (inclusive), before 8.0.29 (exclusive)
microsoft

.net · from 9.0.0 (inclusive), before 9.0.18 (exclusive)
microsoft

.net · from 10.0.0 (inclusive), before 10.0.6 (exclusive)
microsoft

.net framework · 3.5
microsoft

visual studio 2022 · from 17.12.0 (inclusive), before 17.12.22 (exclusive)
microsoft

visual studio 2022 · from 17.14.0 (inclusive), before 17.14.36 (exclusive)
microsoft

visual studio 2026 · from 18.7.0 (inclusive), before 18.7.4 (exclusive)
microsoft

.NET 10.0 · 10.0.0 to before 10.0.10
Microsoft

.NET 8.0 · 8.0.0 to before 8.0.29
Microsoft

.NET 9.0 · 9.0.0 to before 9.0.18
Microsoft

Microsoft .NET Framework 3.5 · 3.5.0 to before 2.0.50727.8983 & 3.0.30729.8978
Microsoft

Microsoft .NET Framework 3.5 AND 4.7.2 · 4.7.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
Microsoft

Microsoft .NET Framework 3.5 AND 4.8 · 4.8.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
Microsoft

Microsoft .NET Framework 3.5 AND 4.8.1 · 4.8.1 to before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
Microsoft

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · 4.7.0 to before 4.7.4143.0
Microsoft

Microsoft .NET Framework 4.8 · 4.8.0 to before 4.8.4803.0
Microsoft

Microsoft .NET Framework 4.8.1 · 4.8.0.0 to before 4.8.9340.0
Microsoft

Microsoft Visual Studio 2022 version 17.12 · 17.12.0 to before 17.12.22
Microsoft

Microsoft Visual Studio 2022 version 17.14 · 17.14.0 to before 17.14.36
Microsoft

Microsoft Visual Studio 2026 version 18.7 · 18.0 to before 18.7.4
Microsoft

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authorized attacker can perform spoofing over a network. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as none; integrity impact as high.