CVE-2026-50659: Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

mediumCVSS 6.5CVE-2026-50659

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: medium — CVSS 6.5
Published: 2026-07-14
Last updated: 2026-07-21
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-50659

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-506590.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-50659	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Microsoft DeveloperTools: Multiple vulnerabilitiescert-bund
mediumGHSA-74jp-vm22-8q8x: Microsoft Security Advisory CVE-2026-50659 – .NET Spoofing Vulnerabilityghsa
unknownUSN-8553-1: .NET vulnerabilitiesubuntu
unknownMultiple vulnerabilities in Microsoft .Net (July 15, 2026)cert-fr-avis
unknownNCSC-2026-0235 [1.00] [M/H] Vulnerabilities fixed in Microsoft Developer Toolsncsc-nl
mediumCVE-2026-50659: .NET Spoofing Vulnerabilitymsrc

Recent advisories for Improper encoding or

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumGHSA-cx96-42px-69fm: Dompdf: Local file read due to improper file path validation in SVG images encoded as dat…ghsa · 2026-07-22
criticalCVE-2026-48358: Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that co…nvd · 2026-07-14
criticalCVE-2026-59083: Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valv…nvd · 2026-07-14
mediumCVE-2026-49844: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in …nvd · 2026-07-10
criticalexploitedCVE-2026-20245: Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerabilitycisa-kev · 2026-06-09
lowGHSA-xh5h-p8c5-4w4x: Duplicate Advisory: uutils coreutils has an Improper Handling of Unicode Encoding Issueghsa · 2026-04-22