CVE-2026-62909

Analyzed Analyzed - Analysis Complete

.NET Unauthorized Privilege Escalation Vulnerability

Publication date: 2026-08-11

Last updated on: 2026-08-14

Assigner: Microsoft Corporation

Description

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-14

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-62909

EUVD

EUVD-2026-56412

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	visual_studio_2022	From 17.14.0 (inc) to 17.14.38 (exc)
microsoft	visual_studio_2026	From 18.8.0 (inc) to 18.8.3 (exc)
microsoft	.net	From 10.0.0 (inc) to 10.0.11 (exc)
microsoft	.net	From 8.0.0 (inc) to 8.0.30 (exc)
microsoft	.net	From 9.0.0 (inc) to 9.0.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-252	The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability is an elevation of privilege issue in .NET where an authorized attacker can exploit an uncaught exception to gain higher privileges locally.

Detection Guidance

Detection methods are not specified in the provided context. Monitor .NET application logs for unhandled exceptions that may indicate privilege escalation attempts.

Impact Analysis

An attacker with local access could escalate their privileges, potentially gaining control over the system or accessing sensitive data.

Compliance Impact

This vulnerability allows local privilege escalation, which could enable unauthorized access to sensitive data or system functions. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) if exploited.

Mitigation Strategies

Apply the latest .NET security updates from Microsoft as soon as they become available to address the uncaught exception issue.

Hi! I’m here to help you understand CVE-2026-62909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70