CVE-2026-69805 is a high severity flaw in .NET (Microsoft.Diagnostics.Runtime), scored 7.5 by the record. Per the NVD record, it allows an unauthorized attacker to elevate privileges over a network. The record does not state a fixed build, so use the Microsoft advisory for the update that applies to your version and apply it.
What's affected
The NVD record lists these affected products: microsoft.diagnostics.runtime; Visual Studio 2022; Visual Studio 2026.
The record describes the issue this way: External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
The record gives a CVSS 3.1 base score of 7.5 (HIGH), published 2026-09-08, with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vector reads as follows. Access is over the network, attack complexity is high, and privileges required are none. A user has to take some action. Scope is unchanged. Confidentiality, integrity and availability impact are high, high and high.
Microsoft publishes fixed builds on its Security Update Guide, and that page needs a browser to render, so we could not read it automatically. Take version details from there. Where Microsoft's advisory differs from this record on severity or versions, trust the advisory and note the difference in your own tracking.
How to check if you're exposed
The record lists the Microsoft.Diagnostics.Runtime library as well as Visual Studio 2022 and 2026. For projects, list the packages you actually restore, including transitive ones.
dotnet list package --include-transitive
Search that output for Microsoft.Diagnostics.Runtime. For Visual Studio, open Help, then About Microsoft Visual Studio, and compare the version with the advisory.
What to do now
- Read the Microsoft advisory and note the fixed package and Visual Studio versions.
- Update Microsoft.Diagnostics.Runtime in the projects that reference it and rebuild.
- Update Visual Studio 2022 and 2026 installs to the fixed version.
- Rescan your dependencies to confirm nothing still pulls the old package.
Why it matters
CWE-200 (exposure of sensitive information) describes a weakness where information reaches a party who is not meant to see it. CWE-522 (insufficiently protected credentials) describes a weakness where credentials are handled in a way that lets them be read or reused by the wrong party. CWE-73 (external control of file name or path) describes a weakness where outside input is allowed to influence which file or path the program touches.
A library or IDE component reaches many projects through shared tooling. Inventory is the first step, because you cannot update what you cannot list.
The record lists three weakness types together, covering file path control, information exposure and weak credential handling. Read the advisory to see how they combine.
The record's kev field is false, so the record does not list this CVE in CISA's Known Exploited Vulnerabilities catalog, and no fetched advisory said it was exploited. That is a snapshot, not a promise, so keep watching.
Safeguard's Gold page for this CVE tracks the record, and the free in-browser scan can check dependency manifests for related issues. Reachability analysis helps with libraries, though it does not apply to operating system patches.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this CVE appear in the CISA Known Exploited Vulnerabilities list?
The record's kev field is false, so it is not listed in CISA's catalog as of the record we hold. That can change, so check the catalog if you are prioritizing.
Is this a Windows patch or a package update?
Both are possible. The record lists a library and two Visual Studio versions, so patch the IDE and check which projects reference the package.
Sources
- Microsoft Security Update Guide entry for CVE-2026-69805 (the page did not return readable advisory text to our automated fetch, so confirm details there)
- NVD record for CVE-2026-69805 as supplied in the Safeguard batch data
Last reviewed: 18 October 2026.
