CVE-2026-58649: .NET Information Disclosure Vulnerability
Published Sep 8, 2026
·Updated
.NET Information Disclosure Vulnerability
Other sources
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
— Microsoft
Affected Software
32 affected componentsFixes available
Microsoft .NET 9.0 installed on Mac OS<9.0.120, 9.0.317
9.0.120, 9.0.317
Microsoft .NET 10.0 installed on Linux<10.0.111, 10.0.400
10.0.111, 10.0.400
Microsoft .NET 10.0 installed on Windows<10.0.111, 10.0.400
10.0.111, 10.0.400
Microsoft .NET 11.0 installed on Windows<11.0 RC1
11.0 RC1
Microsoft Visual Studio 2026=18.9
18.9.3
Microsoft .NET 10.0 installed on Mac OS<10.0.111, 10.0.400
10.0.111, 10.0.400
Microsoft .NET 8.0 installed on Linux<8.0.130, 8.0.424
8.0.130, 8.0.424
Microsoft .NET 8.0 installed on Windows<8.0.130, 8.0.424
8.0.130, 8.0.424
Microsoft .NET 9.0 installed on Windows<9.0.120, 9.0.317
9.0.120, 9.0.317
Microsoft .NET 9.0 installed on Linux<9.0.120, 9.0.317
9.0.120, 9.0.317
Microsoft .NET 11.0 installed on Mac OS<11.0 RC1
11.0 RC1
Microsoft .NET 8.0 installed on Mac OS<8.0.130, 8.0.424
8.0.130, 8.0.424
Microsoft .NET 11.0 installed on Linux<11.0 RC1
11.0 RC1
Microsoft Visual Studio 2022=17.14
17.14.40
All of the following
Any of the following
Microsoft .NET=11.0.0-preview1
Microsoft .NET=11.0.0-preview2
Microsoft .NET=11.0.0-preview3
Microsoft .NET=11.0.0-preview4
Microsoft .NET=11.0.0-preview5
Microsoft .NET=11.0.0-preview6
Microsoft .NET=11.0.0-preview7
Microsoft .net Sdk>=8.0.100<8.0.130
Microsoft .net Sdk>=8.0.200<8.0.424
Microsoft .net Sdk>=9.0.100<9.0.120
Microsoft .net Sdk>=9.0.200<9.0.317
Microsoft .net Sdk>=10.0.100<10.0.111
Microsoft .net Sdk>=10.0.200<10.0.400
Any of the following
Apple macOS
Linux Linux kernel
Microsoft Windows
Microsoft Visual Studio 2022>=17.14.0<17.14.40
Microsoft Visual Studio 2026>=18.9.0<18.9.3
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·05:17 PM
Data Sourced
via MITRE·05:17 PM
DescriptionSeverity
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 PM
RemedyAffected Software
Sep 10, 2026
Data Sourced
via Ubuntu·09:38 AM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·09:39 AM
Description
Data Sourced
via Debian·09:39 AM
DescriptionAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker can attempt exploitation over a network without prior privileges, but user interaction is required.
2
Which environments are identified as affected?
The listed affected software includes Microsoft Visual Studio 2026 and Microsoft .NET 9.0, 10.0, and 11.0 installations across Linux, Windows, and macOS, with .NET 11.0 specifically listed for Windows.