CVE-2026-50526 .NET Tampering Vulnerability
An authorized local attacker can tamper with files via improper link resolution in .NET and Visual Studio, requiring a patch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50526?
CVE-2026-50526 is a high-severity path traversal vulnerability in Microsoft .Net, published on 14 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.
Which versions are affected by CVE-2026-50526?
8 open source packages ship an affected version, including Microsoft.NET.Build.Containers, dotnet and dotnet-sdk. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
Microsoft.NET.Build.Containers NuGet | From 10.0.0 | 10.0.10 |
Microsoft.NET.Build.Containers NuGet | From 10.0.0 | 10.0.10 |
Microsoft.NET.Build.Containers NuGet | From 8.0.0 | 8.0.29 |
Microsoft.NET.Build.Containers NuGet | From 8.0.0 | 8.0.29 |
Microsoft.NET.Build.Containers NuGet | From 9.0.0 | 9.0.18 |
Microsoft.NET.Build.Containers NuGet | From 9.0.0 | 9.0.18 |
2 more packages
dotnet Bitnami | From 8.0.0 | 8.0.29, 9.0.18, 10.0.6 |
dotnet-sdk Bitnami | From 8.0.0 | 8.0.29, 9.0.18, 10.0.6 |
Products include Microsoft .Net, Microsoft Visual Studio 2022, Microsoft Visual Studio 2026.
How do I fix CVE-2026-50526?
Upgrade Microsoft.NET.Build.Containers to a fixed version for your release line: 10.0.10, 8.0.29 or 9.0.18.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-50526 being exploited?
There is no known exploitation of CVE-2026-50526 in the wild and no public exploit code.
Other vulnerabilities in Microsoft .Net
- CVE-2024-43498 .NET and Visual Studio Remote Code Execution Vulnerability
- CVE-2024-0057 NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability
- CVE-2026-96957 .NET Security Feature Bypass Vulnerability
- CVE-2026-69439 .NET and Visual Studio Elevation of Privilege Vulnerability
- CVE-2026-71328 .NET and Visual Studio Remote Code Execution Vulnerability
Sources
Also known as BIT-dotnet-2026-50526, BIT-dotnet-sdk-2026-50526, GHSA-55jh-fwmh-39m4, MINI-9vmm-g94f-qvm9, MINI-qv3g-jj47-h48q, UBUNTU-CVE-2026-50526.