--- id: CVE-2026-58649 title: >- Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. summary: >- Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N' cwe: - CWE-346 vendor: microsoft product: .net affected: - .net = 11.0.0 - '.net_sdk >= 8.0.100, < 8.0.130' - '.net_sdk >= 8.0.200, < 8.0.424' - '.net_sdk >= 9.0.100, < 9.0.120' - '.net_sdk >= 9.0.200, < 9.0.317' - '.net_sdk >= 10.0.100, < 10.0.111' - '.net_sdk >= 10.0.200, < 10.0.400' - 'visual_studio_2022 >= 17.14.0, < 17.14.40' - 'visual_studio_2026 >= 18.9.0, < 18.9.3' patched: - .net_sdk 10.0.400 - visual_studio_2022 17.14.40 - visual_studio_2026 18.9.3 published: '2026-09-08' updated: '2026-10-07' sourceUpdated: '2026-10-07T15:05:42.297' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58649' references: - url: 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58649' label: secure@microsoft.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58649.json - url: 'https://access.redhat.com/security/cve/CVE-2026-58649' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2528870' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-58649' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58649' - url: >- https://github.com/dotnet/dotnet/commit/882ef164b92836bf0cabcf8eb8719274e9dc075e - url: >- https://github.com/dotnet/dotnet/commit/ae39133877be792de27db50aaf415b5e9f003e11 - url: >- https://github.com/dotnet/sdk/commit/71ec9905155a8271ee90d42c20aaa54b9425f4ae - url: >- https://github.com/dotnet/sdk/commit/97124d73362451fe8c40ab5dbaab3396908029cb - url: >- https://github.com/dotnet/sdk/commit/d78666eeb83defc38c76bdf36f57a9a37b8e6e2a - url: >- https://github.com/dotnet/sdk/commit/de67b096e71fd0df5ebe2cfd517270651f9f8ef6 - url: 'https://access.redhat.com/errata/RHSA-2026:67525' - url: 'https://access.redhat.com/errata/RHSA-2026:67528' - url: 'https://access.redhat.com/errata/RHSA-2026:67530' - url: 'https://access.redhat.com/errata/RHSA-2026:68233' - url: 'https://access.redhat.com/errata/RHSA-2026:67613' - url: 'https://access.redhat.com/errata/RHSA-2026:67524' - url: 'https://access.redhat.com/errata/RHSA-2026:67614' - url: 'https://access.redhat.com/errata/RHSA-2026:68316' - url: 'https://access.redhat.com/errata/RHSA-2026:68676' - url: 'https://access.redhat.com/errata/RHSA-2026:66863' - url: 'https://access.redhat.com/errata/RHSA-2026:77004' - url: 'https://access.redhat.com/errata/RHSA-2026:76978' - url: 'https://access.redhat.com/errata/RHSA-2026:88474' - url: 'https://access.redhat.com/errata/RHSA-2026:88424' - url: 'https://access.redhat.com/errata/RHSA-2026:88425' - url: 'https://access.redhat.com/errata/RHSA-2026:88422' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-09-08T19:45:24.737506Z' epss: 0.00359 epssPercentile: 0.29501 ingestedAt: '2026-09-08T18:07:34.911Z' --- ## Overview Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. ## Affected - `.net = 11.0.0` - `.net_sdk >= 8.0.100, < 8.0.130` - `.net_sdk >= 8.0.200, < 8.0.424` - `.net_sdk >= 9.0.100, < 9.0.120` - `.net_sdk >= 9.0.200, < 9.0.317` - `.net_sdk >= 10.0.100, < 10.0.111` - `.net_sdk >= 10.0.200, < 10.0.400` - `visual_studio_2022 >= 17.14.0, < 17.14.40` - `visual_studio_2026 >= 18.9.0, < 18.9.3` ## Remediation Upgrade past the affected range: - `.net_sdk 10.0.400` - `visual_studio_2022 17.14.40` - `visual_studio_2026 18.9.3` ## Vendor advisories - **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-58649.json) - **RHSA-2026:67525** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67525) - **RHSA-2026:67528** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67528) - **RHSA-2026:67530** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67530) - **RHSA-2026:68233** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68233) - **RHSA-2026:67613** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67613) - **RHSA-2026:67524** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67524) - **RHSA-2026:67614** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67614) - **RHSA-2026:68316** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68316) - **RHSA-2026:68676** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68676) - **RHSA-2026:66863** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:66863) - **RHSA-2026:77004** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:77004) - **RHSA-2026:88474** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88474) - **RHSA-2026:88424** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88424) - **RHSA-2026:88425** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88425) - **RHSA-2026:88422** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-10-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:88422)