MicrosoftCVE-2026-50526

Microsoft .NET 10.0: tampering

High7.0CVE-2026-50526 · Published Jul 14, 2026 · updated Jul 22, 2026

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
.NET 10.0 Product	>= 10.0.0, < 10.0.10	10.0.10
.NET 8.0 Product	>= 8.0.0, < 8.0.29	8.0.29
.NET 9.0 Product	>= 9.0.0, < 9.0.18	9.0.18
Microsoft Visual Studio 2022 version 17.12 Product	>= 17.12.0, < 17.12.22	17.12.22
Microsoft Visual Studio 2022 version 17.14 Product	>= 17.14.0, < 17.14.36	17.14.36
Microsoft Visual Studio 2026 version 18.7 Product	>= 18.0, < 18.7.4	18.7.4

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-59, CWE-345

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Jul 14	Secret exfiltration vulnerability HighJul 14 CVE-2026-472821.128.1	High	1.128.1
Jul 14	Workspace Trust Security Feature Bypass Vulnerability HighJul 14 CVE-2026-571011.128.1	High	1.128.1
Jul 14	Remote Code Execution Vulnerability HighJul 14 CVE-2026-571021.128.1	High	1.128.1
Jul 14	Microsoft .NET 8.0: unsafe deserialization High7.8Jul 14 CVE-2026-506498.0.29+9 more	High7.8	8.0.29+9 more
Jul 14	Microsoft .NET 8.0: code injection High7.8Jul 14 CVE-2026-506508.0.29+10 more	High7.8	8.0.29+10 more
Jul 14	Microsoft .NET 10.0: resource exhaustion High7.5Jul 14 CVE-2026-5065110.0.10+5 more	High7.5	10.0.10+5 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.