CVE-2026-102869
published 2026-10-13CVE-2026-102869: Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
PriorityP356high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.84%
57.5th percentile
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_net_framework_3.5_and_4.6.2_4.7_4.7.1_4.7.2 | >= 3.0.0.0 < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 |
| microsoft | microsoft_net_framework_3.5_and_4.7.2 | >= 4.7.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 |
| microsoft | microsoft_net_framework_3.5_and_4.8 | >= 4.8.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 |
| microsoft | microsoft_net_framework_3.5_and_4.8.1 | >= 4.8.1 < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 |
| microsoft | microsoft_net_framework_4.6.2_4.7_4.7.1_4.7.2 | >= 4.7.0 < 4.7.4150.0 | 4.7.4150.0 |
| microsoft | microsoft_net_framework_4.8 | >= 4.8.0 < 4.8.4811.0 | 4.8.4811.0 |
| microsoft | microsoft_net_framework_4.8.1 | >= 4.8.0.0 < 4.8.9363.0 | 4.8.9363.0 |
| microsoft | microsoft_visual_studio_2022_version_17.14 | >= 17.14.0 < 17.14.42 | 17.14.42 |
| microsoft | microsoft_visual_studio_2026_version_18.10 | >= 18.10.0 < 18.10.4 | 18.10.4 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
ghsa_unreviewed·2026-10-13
CVE-2026-102869 [HIGH] CWE-843 Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
Red Hat
dotnet: .NET and Visual Studio: Privilege escalation via type confusion
vendor_redhat·2026-10-13·CVSS 8.8
CVE-2026-102869 [HIGH] CWE-843 dotnet: .NET and Visual Studio: Privilege escalation via type confusion
dotnet: .NET and Visual Studio: Privilege escalation via type confusion
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
A flaw was found in .NET and Visual Studio. A remote attacker could achieve privilege escalation by exploiting a type confusion vulnerability, which occurs when the software accesses a resource using an incompatible data type. Successful exploitation requires user interaction and may allow an unauthorized attacker to execute actions with elevated privileges over the network.
Statement: An IMPORTANT severity type confusion flaw (access of a resource using an incompatible type) was reported in Microsoft .NET and Visual Studio. A remote, unauthenticated attacker c
No detection rules found.
No public exploits indexed.
Sans Isc
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
blogs_sans_isc·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
October 2026 Microsoft Patch Tuesday
Published: 2026-10-13. Last Updated: 2026-10-13 19:25:52 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.
CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.
CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be
Rapid7
Patch Tuesday - October 2026
blogs_rapid7·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
## Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site
Bugzilla
CVE-2026-102869 dotnet: .NET and Visual Studio: Privilege escalation via type confusion
bugzilla·2026-10-13·CVSS 8.8
CVE-2026-102869 [HIGH] CVE-2026-102869 dotnet: .NET and Visual Studio: Privilege escalation via type confusion
CVE-2026-102869 dotnet: .NET and Visual Studio: Privilege escalation via type confusion
Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
2026-10-13
Published