Microsoft Vulnerabilities and Affected Products
Vulnerabilities associated with Microsoft Visual Studio 2026 version 18.8.
Products
Clear product- Windows Server 20194,131 vulnerabilities
- Windows Server 2019 (Server Core installation)4,034 vulnerabilities
- Windows 10 Version 18093,762 vulnerabilities
- Windows Server 20163,677 vulnerabilities
- Windows Server 20223,485 vulnerabilities
- Windows Server 2016 (Server Core installation)3,473 vulnerabilities
- Windows 10 Version 16073,184 vulnerabilities
- Windows 10 Version 21H23,063 vulnerabilities
- Windows Server 2012 R22,998 vulnerabilities
- Windows Server 2012 R2 (Server Core installation)2,853 vulnerabilities
- Windows Server 20122,824 vulnerabilities
- Windows Server 2012 (Server Core installation)2,691 vulnerabilities
- Windows 10 Version 22H22,565 vulnerabilities
- Windows 10 Version 15072,277 vulnerabilities
- Windows 11 Version 24H21,924 vulnerabilities
- Windows Server 20251,917 vulnerabilities
- Windows Server 2025 (Server Core installation)1,917 vulnerabilities
- Windows Server 2008 R2 Service Pack 11,874 vulnerabilities
- Windows Server 2008 R2 Service Pack 1 (Server Core installation)1,860 vulnerabilities
- Windows 11 Version 23H21,845 vulnerabilities
- Windows 11 version 22H21,776 vulnerabilities
- Windows Server 2022, 23H2 Edition (Server Core installation)1,725 vulnerabilities
- Windows Server 2008 Service Pack 2 (Server Core installation)1,667 vulnerabilities
- Windows Server 2008 Service Pack 21,664 vulnerabilities
- Windows 11 version 21H21,560 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-62898HIGH | Microsoft QUIC Information Disclosure Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Microsoft QUIC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/426 ## CVSS Details - **Ver… CWE-416Aug 11, 2026 | CVSS7.5v3.1 | EPSS1.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-70354HIGH | .NET Core Remote Code Execution Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/432 ## CVSS Details - **Versi… CWE-787Aug 11, 2026 | CVSS7.8v3.1 | EPSS0.387% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62886HIGH | .NET Elevation of Privilege Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/430 ## CVSS D… | CVSS7.8v3.1 | EPSS0.405% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62871HIGH | .NET Elevation of Privilege Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/431 ## CVSS Details - **Version:… | CVSS7.8v3.1 | EPSS0.405% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62909HIGH | .NET Elevation of Privilege Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET diagnostics IPC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A missing error check in .NET causes an improper ACL to be applied to a shared resource, resulting in local elevation of privilege. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issue… | CVSS7.8v3.1 | EPSS0.295% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62902MEDIUM | .NET Information Disclosure Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A specially crafted document parsed in .NET can trigger the inclusion of functionality from an untrusted control sphere, allowing an unauthorized attacker to disclose information over a network. ## Announcement Announcement fo… | CVSS6.5v3.1 | EPSS0.779% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62901HIGH | .NET Denial of Service Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.WebSockets. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/428 ## CVSS Detail… CWE-606Aug 11, 2026 | CVSS7.5v3.1 | EPSS1.08% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62900MEDIUM | .NET Information Disclosure VulnerabilityImproper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. CWE-212Aug 11, 2026 | CVSS5.9v3.1 | EPSS0.558% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62899MEDIUM | .NET Security Feature Bypass Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Net.HttpListener. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network. ## Announcement Announcement for this issue can be found at https://… CWE-444Aug 11, 2026 | CVSS5.9v3.1 | EPSS0.721% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62897HIGH | .NET Framework Remote Code Execution Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An integer overflow or wraparound in .NET allows an unauthorized attacker to execute code locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/434 ## CVSS Details… CWE-190Aug 11, 2026 | CVSS7.0v3.1 | EPSS0.336% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |