AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

MicrosoftCVE-2026-58649

Microsoft .NET 10.0 runtime: origin validation error

Microsoft

CVE-2026-58649 · Published Sep 8, 2026 · updated Oct 30, 2026

Medium6.5
Fix: upgrade to 10.0.111 or later (6 fixed versions below)
Microsoft advisory

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

Affected versions

PackageAffectedFixed in
.NET 10.0 runtime
Product
>= 10.0.0, < 10.0.111, 10.0.40010.0.111, 10.0.400
.NET 11.0 runtime
Product
>= 11.0.0, < 11.0 RC111.0 RC1
.NET 8.0 runtime
Product
>= 8.0.0, < 8.0.130, 8.0.4248.0.130, 8.0.424
.NET 9.0 runtime
Product
>= 9.0.0, < 9.0.120, 9.0.3179.0.120, 9.0.317
Microsoft Visual Studio 2022 version 17.14
Product
>= 17.14.0, < 17.14.4017.14.40
Microsoft Visual Studio 2026 version 18.9
Product
>= 18.9.0, < 18.9.318.9.3

Changes since it was listed

Fixed inNov 3Fixed in: .NET 10.0 10.0.111, 10.0.400, .NET 11.0 11.0 RC1, .NET 8.0 8.0.130, 8.0.424 to .NET 10.0 runtime 10.0.111, 10.0.400, .NET 11.0 runtime 11.0 RC1, .NET 8.0 runtime 8.0.130, 8.0.424
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-346

More Microsoft advisories

All Microsoft
High 8.3Sep 8Microsoft Skype for Business: spoofingCVE-2026-69646fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: cross-site scriptingCVE-2026-69642fixed in 6.0.9319.885 +2High 7.1Sep 8Microsoft Skype for Business: spoofingCVE-2026-66305fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: information disclosureCVE-2026-66306fixed in 6.0.9319.885 +2High 7.5Sep 8Microsoft Skype for Business: integer overflowCVE-2026-66307fixed in 6.0.9319.885 +2Medium 6.5Sep 8Microsoft Skype for Business: out-of-bounds readCVE-2026-66308fixed in 6.0.9319.885 +2