{"history":[{"alert":0,"cve":"CVE-2026-114151","id":23079,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.01492, \"percentile\": 0.74505}"},{"alert":1,"cve":"CVE-2026-114151","id":21358,"kind":"cna","observed_at":1794500401,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-114151\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-10T20:03:36.800942Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T20:09:28.872Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \".NET 10.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.15\", \"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 11.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"11.0.0\", \"status\": \"affected\", \"version\": \"11.0.0-preview.1\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 8.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"8.0.34\", \"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 9.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"9.0.23\", \"status\": \"affected\", \"version\": \"9.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2026 version 18.12\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"18.12.0\", \"status\": \"affected\", \"version\": \"18.12.0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.0.34\", \"versionStartIncluding\": \"8.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.0.23\", \"versionStartIncluding\": \"9.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.15\", \"versionStartIncluding\": \"10.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.0.0\", \"versionStartIncluding\": \"11.0.0-preview.1\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.12.0\", \"versionStartIncluding\": \"18.12.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"datePublic\": \"2026-11-10T16:00:00.000Z\", \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\", \"lang\": \"en-US\", \"type\": \"CWE\"}, {\"cweId\": \"CWE-121\", \"description\": \"CWE-121: Stack-based Buffer Overflow\", \"lang\": \"en-US\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-12T15:44:23.071Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"name\": \"Visual Studio Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151\"}], \"title\": \"Visual Studio Remote Code Execution Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2026-114151\", \"datePublished\": \"2026-11-10T18:19:14.695Z\", \"dateReserved\": \"2026-10-20T21:56:39.317Z\", \"dateUpdated\": \"2026-11-12T15:44:23.071Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":1,"cve":"CVE-2026-114151","id":21096,"kind":"cna","observed_at":1794392402,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2026-114151\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2026-11-10T20:03:36.800942Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T20:09:28.872Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \".NET 10.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"10.0.15\", \"status\": \"affected\", \"version\": \"10.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 11.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"11.0.0\", \"status\": \"affected\", \"version\": \"11.0.0-preview.1\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 8.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"8.0.34\", \"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \".NET 9.0 installed on Windows\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"9.0.23\", \"status\": \"affected\", \"version\": \"9.0.0\", \"versionType\": \"custom\"}]}, {\"product\": \"Microsoft Visual Studio 2026 version 18.12\", \"vendor\": \"Microsoft\", \"versions\": [{\"lessThan\": \"18.12.0\", \"status\": \"affected\", \"version\": \"18.12.0\", \"versionType\": \"custom\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"8.0.34\", \"versionStartIncluding\": \"8.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"9.0.23\", \"versionStartIncluding\": \"9.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"10.0.15\", \"versionStartIncluding\": \"10.0.0\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"11.0.0\", \"versionStartIncluding\": \"11.0.0-preview.1\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"18.12.0\", \"versionStartIncluding\": \"18.12.0\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"datePublic\": \"2026-11-10T16:00:00.000Z\", \"descriptions\": [{\"lang\": \"en-US\", \"value\": \"Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\", \"lang\": \"en-US\", \"type\": \"CWE\"}, {\"cweId\": \"CWE-121\", \"description\": \"CWE-121: Stack-based Buffer Overflow\", \"lang\": \"en-US\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-10T23:50:48.148Z\", \"orgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"shortName\": \"microsoft\"}, \"references\": [{\"name\": \"Visual Studio Remote Code Execution Vulnerability\", \"tags\": [\"vendor-advisory\", \"patch\"], \"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151\"}], \"title\": \"Visual Studio Remote Code Execution Vulnerability\"}}, \"cveMetadata\": {\"assignerOrgId\": \"f38d906d-7342-40ea-92c1-6c4a2c6478c8\", \"assignerShortName\": \"microsoft\", \"cveId\": \"CVE-2026-114151\", \"datePublished\": \"2026-11-10T18:19:14.695Z\", \"dateReserved\": \"2026-10-20T21:56:39.317Z\", \"dateUpdated\": \"2026-11-10T23:50:48.148Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-114151","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-10T20:03:36.800942Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-10T20:09:28.872Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":".NET 10.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"10.0.15","status":"affected","version":"10.0.0","versionType":"custom"}]},{"product":".NET 11.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"11.0.0","status":"affected","version":"11.0.0-preview.1","versionType":"custom"}]},{"product":".NET 8.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"8.0.34","status":"affected","version":"8.0.0","versionType":"custom"}]},{"product":".NET 9.0 installed on Windows","vendor":"Microsoft","versions":[{"lessThan":"9.0.23","status":"affected","version":"9.0.0","versionType":"custom"}]},{"product":"Microsoft Visual Studio 2026 version 18.12","vendor":"Microsoft","versions":[{"lessThan":"18.12.0","status":"affected","version":"18.12.0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.34","versionStartIncluding":"8.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0.23","versionStartIncluding":"9.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"10.0.15","versionStartIncluding":"10.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*","versionEndExcluding":"11.0.0","versionStartIncluding":"11.0.0-preview.1","vulnerable":true},{"criteria":"cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.12:*:*:*:*:*:*:*:*","versionEndExcluding":"18.12.0","versionStartIncluding":"18.12.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"datePublic":"2026-11-10T16:00:00.000Z","descriptions":[{"lang":"en-US","value":"Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network."}],"metrics":[{"cvssV3_1":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en-US","type":"CWE"},{"cweId":"CWE-121","description":"CWE-121: Stack-based Buffer Overflow","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T15:44:23.071Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"Visual Studio Remote Code Execution Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151"}],"title":"Visual Studio Remote Code Execution Vulnerability"}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2026-114151","datePublished":"2026-11-10T18:19:14.695Z","dateReserved":"2026-10-20T21:56:39.317Z","dateUpdated":"2026-11-12T15:44:23.071Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-114151","description":"Deserialization of untrusted data in Visual Studio allows an unauthorized attacker to execute code over a network.","epss":{"date":"2026-11-12","epss":0.01492,"percentile":0.74505},"epss_checked":1794522003,"first_seen":1794376805,"kev":null,"kev_checked":1794522003,"products":"Microsoft .NET 10.0 installed on Windows, Microsoft .NET 11.0 installed on Windows, Microsoft .NET 8.0 installed on Windows, Microsoft .NET 9.0 installed on Windows, Microsoft Microsoft Visual Studio 2026 version 18.12","references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114151"],"score":{"baseScore":8.8,"baseSeverity":"HIGH","provider":"microsoft","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Visual Studio Remote Code Execution Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://github.com/advisories/GHSA-fpxj-5c99-g7vj","id":336,"publisher":"GitHub Advisory Database","title":"Microsoft Security Advisory CVE-2026-114151 - Visual Studio Remote Code Execution Vulnerability"}]}