USN-8641-1: .NET vulnerabilities
Miha Zupan discovered that .NET did not properly interpret certain HTTP requests. An attacker could possibly use this issue to perform request smuggling and bypass a security feature. (CVE-2026-62899) Ivan Demchuk discovered that .NET did not properly handle the removal of sensitive information before storage or transfer. An attacker could possibly use this issue to disclose sensitive information. (CVE-2026-62900) Kevin Gosse discovered that .NET did not properly check an input for a loop condition. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-62901) Kevin Gosse discovered that .NET did not properly perform error checking when securing shared resources used for diagnostics IPC. An attacker could possibly use this issue to elevate privileges. (CVE-2026-62909)
CSIRTS triage
- What
- Multiple vulnerabilities in .NET including HTTP request smuggling, sensitive information disclosure, loop condition bypass, and privileged IPC error handling.
- Who is affected
- All .NET deployments using the affected versions.
- Urgency
- Unknown severity but spans multiple vulnerability classes affecting request handling, privilege escalation, and denial-of-service.
- Action
- Apply .NET security patches addressing CVE-2026-62899, CVE-2026-62900, CVE-2026-62901, and CVE-2026-62909.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch .NET
Get an email when a new .NET advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://ubuntu.com/security/notices/USN-8641-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-628990.71% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-629000.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-629011.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 61% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-629090.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-62899 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62900 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62901 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62909 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] Microsoft Developer Tools: Multiple Vulnerabilitiescert-bund
- unknownMultiple vulnerabilities in Microsoft products (August 12, 2026)cert-fr-avis
- unknownMultiple vulnerabilities in Microsoft .Net (August 12, 2026)cert-fr-avis
- unknownNCSC-2026-0285 [1.00] [M/H] Vulnerabilities patched in Microsoft Developer Toolsncsc-nl
- mediumGHSA-9mr8-pwpw-3j2w: Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerabilityghsa
- highGHSA-m93f-wj8c-rp8p: Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerabilityghsa
- mediumGHSA-r6mh-95jw-g7qg: Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerabilityghsa
- highCVE-2026-62909: Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.nvd
- highCVE-2026-62901: Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service ove…nvd
- mediumCVE-2026-62900: Improper removal of sensitive information before storage or transfer in .NET allows an unautho…nvd
- mediumCVE-2026-62899: Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allow…nvd
- highCVE-2026-62901: .NET Denial of Service Vulnerabilitymsrc
More from Ubuntu Security Notices
- unknownUSN-8659-4: Linux kernel (Oracle) vulnerability2026-08-26
- unknownUSN-8666-2: Linux kernel (Azure) vulnerabilities2026-08-25
- unknownUSN-8630-5: Linux kernel (Raspberry Pi) vulnerabilities2026-08-25
- unknownUSN-8658-3: Linux kernel vulnerabilities2026-08-25
- unknownUSN-8643-4: Linux kernel vulnerabilities2026-08-25