---
cve: "CVE-2026-62902"
severity: "MEDIUM"
cvss: 6.5
epss: "0.9%"
vendor: "Microsoft"
kev: false
exploited: false
published: "2026-08-11 17:18:44"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-06T12:05:04+01:00"
---

# CVE-2026-62902

> 6.5 MEDIUM

## Beschreibung

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.

## CNA-Record (Kanon, cvelistV5)

- CNA: **microsoft**
- State: PUBLISHED
- Stand: 2026-10-30 17:20:28
- CNA-CVSS: **6.5** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-693** — Protection Mechanism Failure
  The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
- **CWE-829** — Inclusion of Functionality from Untrusted Control Sphere
  The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
- **CWE-918** — Server-Side Request Forgery
  The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_
- [CAPEC-17 — Using Malicious Files](https://capec.mitre.org/data/definitions/17.html) _(Severity: Very High)_
- [CAPEC-20 — Encryption Brute Forcing](https://capec.mitre.org/data/definitions/20.html) _(Severity: Low)_
- [CAPEC-22 — Exploiting Trust in Client](https://capec.mitre.org/data/definitions/22.html) _(Severity: High)_
- [CAPEC-36 — Using Unpublished Interfaces or Functionality](https://capec.mitre.org/data/definitions/36.html) _(Severity: High)_
- [CAPEC-107 — Cross Site Tracing](https://capec.mitre.org/data/definitions/107.html) _(Severity: Very High)_
- [CAPEC-127 — Directory Indexing](https://capec.mitre.org/data/definitions/127.html) _(Severity: Medium)_
- [CAPEC-237 — Escaping a Sandbox by Calling Code in Another Language](https://capec.mitre.org/data/definitions/237.html) _(Severity: Very High)_

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)
- [T1574.005 — Hijack Execution Flow: Executable Installer File Permissions](https://attack.mitre.org/techniques/T1574/005/)
- [T1083 — File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)

## Patch verfügbar (OSV)

- 808c6af9a9cb4e3d6680f36180e55cb2aeb0ce26
- 808c6af9a9cb4e3d6680f36180e55cb2aeb0ce26

## BSI-Hinweise (deutsch)

- [Microsoft Developer Tools: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2761) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio Code, Microsoft Windows Server 2012, Microsoft Windows Server 2012 R2, Microsoft Windows Server 2016, Microsoft .NET Framework, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2025, Microsoft PowerShell, Microsoft Windows, Microsoft .NET, Microsoft Visual Studio 2022 und Microsoft Visual Studio 2026 ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

## Referenzen

- <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62902>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-62902/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_