USN-8740-1: .NET vulnerabilities
Weeraphat Srisutham discovered that the .NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-58649) Rajesh Chada discovered that the .NET watch AspireServerService improperly exposed information through the use of certain arguments. An attacker could possibly use this issue to elevate privileges and execute arbitrary code. (CVE-2026-69806)
Details
Original advisory: https://ubuntu.com/security/notices/USN-8740-1
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-586490.27% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 19% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-698061.8% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 77% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-58649 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-69806 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[UPDATE] [hoch] Microsoft Entwicklerwerkzeuge: Mehrere Schwachstellen ermöglichen Privilegieneskalationcert-bund
- unknownMultiples vulnérabilités dans Microsoft .Net (09 septembre 2026)cert-fr-avis
- unknownNCSC-2026-0351 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Developer Toolsncsc-nl
- highCVE-2026-69806: Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attack…nvd
- mediumCVE-2026-58649: Origin validation error in .NET allows an unauthorized attacker to disclose information over a…nvd
- highCVE-2026-69806: .NET Elevation of Privilege Vulnerabilitymsrc
- mediumCVE-2026-58649: .NET Information Disclosure Vulnerabilitymsrc
More from Ubuntu Security Notices
- unknownUSN-8742-1: Netty vulnerability2026-09-10
- unknownUSN-8741-1: Flatpak vulnerabilities2026-09-10
- unknownUSN-8716-2: FFmpeg vulnerabilities2026-09-09
- unknownUSN-8675-2: Perl vulnerabilities2026-09-09
- unknownUSN-8739-1: ImageMagick vulnerabilities2026-09-08