CVE-2026-69805CWE-200CWE-522CWE-73information-disclosure

CVE-2026-69805

High · published September 8, 2026

CVSS v3.1

7.5

EPSS

Percentile

41.7

In the wild

Unconfirmed

What it is

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00496 · 41.7th percentile
Weaknesses: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-522 · Insufficiently Protected Credentials; CWE-73 · External Control of File Name or Path
Published: 2026-09-08T22:19Z

Affected products (3)

Product	Versions	Fixed in
microsoft/microsoft.diagnostics.runtime	< 4.1.740301	4.1.740301
microsoft/visual_studio_2022	≥ 17.14.0, < 17.14.40	17.14.40
microsoft/visual_studio_2026	≥ 18.9.0, < 18.9.3	18.9.3

References (1)

EPSS history

Timeline