Inclusion of Functionality from Untrusted Control Sphere in Microsoft products - CVE-2026-62902

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information over a network.

The vulnerability exists due to inclusion of functionality from untrusted control sphere in .NET when processing untrusted functionality. A remote attacker can trigger the vulnerable behavior to disclose sensitive information over a network.

User interaction is required to exploit the issue, and successful exploitation could disclose NTLM hashes.

Affected software

How to mitigate CVE-2026-62902

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-62902
• https://support.microsoft.com/help/5122106

Related Security Bulletins

• Multiple vulnerabilities in Microsoft .NET Framework