Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-66822 · GHSA-wxxw-5cvc-53j7

Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

Risk score
56/100
CVSS
5.9 v3.1
Exploit chance (30 days)
0.7%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
Affected
Microsoft.NETCore.App.Runtime.linux-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm64 (nuget) >= 9.0.0, <= 9.0.20
Fix
Upgrade Microsoft.NETCore.App.Runtime.linux-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-x64 to 9.0.21; Microsoft.NETCore…
Exploitation
No known exploitation

Story map

Story map: Microsoft.NETCore.App.Runtime.linux-armTHE FLAWSTHE FIXCVE-2026-66822Microsoft Security AdvisoryCVE-2026-66822 - .NET andVisual Studio Information…CVSS 5.9 · EPSS 1%CVE-2026-69651Microsoft Security AdvisoryCVE-2026-69651 - .NET andVisual Studio Denial of Service…CVSS 7.5 · EPSS 1%CVE-2026-58280Microsoft Security AdvisoryCVE-2026-58280 - .NET andVisual Studio Denial of Service…CVSS 7.5 · EPSS 1%CVE-2026-96233Microsoft Security AdvisoryCVE-2026-96233 - .NET andVisual Studio Denial of Service…CVSS 7.5 · EPSS 1%FixUpgradeMicrosoft.NETCore.App.Runtime.linux-arm to 9.0.21;Microsoft.NETCore.App.Runti…Who is exposedMicrosoft.NETCore.App.Runtime.linux-arm (nuget) >= 9.0.0, <=9.0.20;Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >=…AMBER · PATCH THIS WEEKMicrosoft.NETCore.App.Runtime.lin…Inefficient algorithmiccomplexity in .NET allows anunauthorized attacker to denyservice over a network.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-201 (CWE-201)39 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.NETCore.App.Runtime.linux-arm: Amber, patch this week. Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

The flaws

  • CVE-2026-66822: Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability (CVSS 5.9 · EPSS 1%)
  • CVE-2026-69651: Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
  • CVE-2026-58280: Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)
  • CVE-2026-96233: Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.NETCore.App.Runtime.linux-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-arm64 to 9.0.21; Microsoft.NETCore.App.Runtime.linux-musl-x64 to 9.0.21; Microsoft.NETCore…

Who is exposed: Microsoft.NETCore.App.Runtime.linux-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-arm64 (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm (nuget) >= 9.0.0, <= 9.0.20; Microsoft.NETCore.App.Runtime.linux-musl-arm64 (nuget) >= 9.0.0, <= 9.0.20

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • On your watchlist: .net, NuGet

Affected packages

PackageEcosystemVulnerableFixed in
Microsoft.NETCore.App.Runtime.linux-armnuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.linux-arm64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.linux-musl-armnuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.linux-musl-arm64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.linux-musl-x64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.linux-x64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.osx-arm64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.osx-x64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.win-arm64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.win-x64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.win-x86nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.NETCore.App.Runtime.linux-armnuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2

References

Original description

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.