CVE-2026-66822

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in .NET via Sent Data

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-66822

EUVD

EUVD-2026-99277

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	.NET	10.0 10.0.0
Microsoft	.NET	11.0 11.0.0
Microsoft	.NET	8.0 8.0.0
Microsoft	.NET	9.0 9.0.0
Microsoft	Microsoft	Visual Studio 2022 version 17.14 17.14.0
Microsoft	Microsoft	Visual Studio 2026 version 18.10 18.10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves sensitive information being inserted into data sent over a network in .NET applications. An unauthorized attacker could exploit this to access or disclose sensitive data during transmission.

Impact Analysis

An attacker could intercept and read sensitive information sent by affected .NET applications. This may include credentials, personal data, or other confidential details, leading to privacy breaches or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties or compliance violations.

Mitigation Strategies

Apply the latest security updates from Microsoft for .NET 8.0, 9.0, 10.0, and 11.0 as well as Visual Studio 2022 17.14 and 2026 18.10 to patch the information disclosure vulnerability.

Hi! I’m here to help you understand CVE-2026-66822. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70