CVE-2026-50526

Analyzed Analyzed - Analysis Complete

Improper Link Following in .NET Framework

Publication date: 2026-07-14

Last updated on: 2026-07-22

Assigner: Microsoft Corporation

Description

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-22

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-50526

EUVD

EUVD-2026-44394

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	.net	From 8.0.0 (inc) to 8.0.29 (exc)
microsoft	.net	From 9.0.0 (inc) to 9.0.18 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.6 (exc)
microsoft	visual_studio_2022	From 17.12.0 (inc) to 17.12.22 (exc)
microsoft	visual_studio_2022	From 17.14.0 (inc) to 17.14.36 (exc)
microsoft	visual_studio_2026	From 18.7.0 (inc) to 18.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper link resolution before file access in .NET, allowing an authorized attacker to perform tampering locally by exploiting link following.

Detection Guidance

Detection involves monitoring for unauthorized file access or tampering attempts. Check for unusual .NET application behavior, unexpected file modifications, or suspicious symbolic links. Review system logs for access violations or errors related to file operations in .NET environments.

Impact Analysis

An attacker could modify files on your system if they gain local access, potentially leading to unauthorized changes or data corruption.

Compliance Impact

This vulnerability could lead to unauthorized data tampering, which may violate integrity requirements in GDPR or HIPAA if sensitive data is altered.

Mitigation Strategies

Apply the latest security updates from Microsoft for .NET to address the improper link resolution vulnerability. Monitor Microsoft's update guide for patches and install them promptly.

Hi! I’m here to help you understand CVE-2026-50526. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70