MicrosoftCVE-2026-69806

Microsoft .NET 10.0 runtime: information disclosure

CVE-2026-69806 · Published Sep 8, 2026 · updated Oct 30, 2026

High7.0

Fix: upgrade to 10.0.12 or later (5 fixed versions below)

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.

Affected versions

Package	Affected	Fixed in
.NET 10.0 runtime Product	>= 10.0.0, < 10.0.12	10.0.12
.NET 11.0 runtime Product	>= 11.0.0, < 11.0 RC1	11.0 RC1
.NET 9.0 runtime Product	>= 9.0.0, < 9.0.20	9.0.20
Microsoft Visual Studio 2022 version 17.14 Product	>= 17.14.0, < 17.14.40	17.14.40
Microsoft Visual Studio 2026 version 18.9 Product	>= 18.9.0, < 18.9.3	18.9.3

Changes since it was listed

Fixed inNov 3Fixed in: .NET 10.0 10.0.12, .NET 11.0 11.0 RC1, .NET 9.0 9.0.20 to .NET 10.0 runtime 10.0.12, .NET 11.0 runtime 11.0 RC1, .NET 9.0 runtime 9.0.20

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-94, CWE-200

More Microsoft advisories

All Microsoft

High 8.3Sep 8

Microsoft Skype for Business: spoofingCVE-2026-69646fixed in 6.0.9319.885 +2 Medium 6.5Sep 8

Microsoft Skype for Business: cross-site scriptingCVE-2026-69642fixed in 6.0.9319.885 +2 High 7.1Sep 8

Microsoft Skype for Business: spoofingCVE-2026-66305fixed in 6.0.9319.885 +2 Medium 6.5Sep 8

Microsoft Skype for Business: information disclosureCVE-2026-66306fixed in 6.0.9319.885 +2 High 7.5Sep 8

Microsoft Skype for Business: integer overflowCVE-2026-66307fixed in 6.0.9319.885 +2 Medium 6.5Sep 8

Microsoft Skype for Business: out-of-bounds readCVE-2026-66308fixed in 6.0.9319.885 +2