CVE-2026-102869: .NET and Visual Studio Elevation of Privilege Vulnerability
.NET and Visual Studio Elevation of Privilege Vulnerability
Other sources
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0Patch KB5126868 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0Patch KB5127685 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0Patch KB5127683 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4150.0Patch KB5127667 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127692 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0Patch KB5127687 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0Patch KB5127666 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.9363.0Patch KB5127691 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0Patch KB5127694 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127693 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127690 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127689 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4811.0Patch KB5127686 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4811.0Patch KB5127684 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4811.0Patch KB5127688 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4150.0Patch KB5127668
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review deployments of Microsoft .NET Framework, Microsoft .NET, Microsoft Visual Studio, Visual Studio 2022, and Visual Studio 2026. The provided information does not identify specific affected versions or configurations.
What does an attacker need to exploit this issue?
The attack vector is network-based and requires no prior privileges. User interaction is required for exploitation.
What security impact is indicated by the available assessment?
The assessment indicates high potential impact to confidentiality, integrity, and availability. Successful exploitation may allow an unauthorized attacker to elevate privileges.