CVE-2026-58649: 
Visual Studio 2022 vulnerability analysis and mitigation

CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft .NET that allows an unauthenticated network attacker to disclose sensitive information, requiring user interaction to exploit. It was disclosed on September 8, 2026, as part of Microsoft's September 2026 Patch Tuesday. Affected products include .NET 8.0 (before 8.0.130/8.0.424), .NET 9.0 (before 9.0.120/9.0.317), .NET 10.0 (before 10.0.111/10.0.400), .NET 11.0 (before RC1), Microsoft Visual Studio 2022 version 17.14 (before 17.14.40), and Visual Studio 2026 version 18.9 (before 18.9.3). The CVSS v3.1 base score is 6.5 (Medium) (MSRC Advisory, Red Hat Bugzilla).

The root cause is insufficient origin validation in the dotnet watch tool's BrowserRefreshServer component, which fails to adequately validate cross-origin WebSocket connection origins (CWE-346). An attacker who can trick a user into visiting a malicious web page could establish a cross-origin WebSocket connection to the BrowserRefreshServer, potentially extracting IL (Intermediate Language) bytecode and PDB (Program Database) debugging information from the running .NET application. Exploitation requires no privileges but does require user interaction, and the attack is conducted over the network. Fix commits are publicly available in the dotnet/dotnet and dotnet/sdk GitHub repositories (Red Hat Bugzilla).

Successful exploitation results in high confidentiality impact with no integrity or availability impact. An attacker could obtain IL bytecode and PDB debugging symbols from a .NET application running under dotnet watch, which may expose application logic, internal API structures, and sensitive strings embedded in the code. This information could facilitate further targeted attacks against the application or its infrastructure (MSRC Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.0027 (0.27%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable due to the required user interaction (MSRC Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify a target developer or CI/CD environment running dotnet watch with an affected .NET SDK version (8.0.0–8.0.130/8.0.424, 9.0.0–9.0.120/9.0.317, 10.0.0–10.0.111/10.0.400, or 11.0.0 pre-RC1).
2. Lure the victim: Craft a malicious web page that initiates a cross-origin WebSocket connection to the BrowserRefreshServer endpoint exposed by dotnet watch (typically on localhost at a known or discoverable port).
3. Bypass origin validation: Because BrowserRefreshServer does not adequately validate the Origin header of incoming WebSocket upgrade requests, the connection from the malicious page is accepted.
4. Extract sensitive data: Once connected, interact with the BrowserRefreshServer protocol to retrieve IL bytecode and PDB debugging information streamed by the server.
5. Analyze extracted artifacts: Use tools such as ILSpy or dnSpy to decompile the obtained IL and PDB files, revealing application source logic, internal endpoints, and potentially embedded secrets (Red Hat Bugzilla).

• Network: Unexpected WebSocket upgrade requests to the dotnet watch BrowserRefreshServer port (typically a high-numbered localhost port) originating from non-localhost origins; outbound connections from a developer workstation to unknown external hosts shortly after dotnet watch is running.
• Logs: HTTP server logs showing WebSocket upgrade requests with suspicious or external Origin headers targeting the BrowserRefreshServer endpoint.
• Process: dotnet watch process receiving connections from browser processes navigating to external or untrusted URLs while the development server is active.

Microsoft released patches on September 8, 2026. Users should update to the following fixed versions: .NET 8.0 SDK 8.0.131 or 8.0.425; .NET 9.0 SDK 9.0.121 or 9.0.318; .NET 10.0 SDK 10.0.112 or 10.0.401; .NET 11.0 RC1 or later; Visual Studio 2022 17.14.40 or later; Visual Studio 2026 18.9.3 or later. Red Hat Enterprise Linux users should apply the relevant errata (RHSA-2026:67524, RHSA-2026:67525, RHSA-2026:67528, RHSA-2026:67530, RHSA-2026:67613, RHSA-2026:67614). As a workaround, avoid running dotnet watch in environments where untrusted web content can be accessed, or restrict network access to the BrowserRefreshServer port (MSRC Advisory, Red Hat Bugzilla).

The vulnerability was covered as part of broader September 2026 Patch Tuesday roundups by BleepingComputer and the Zero Day Initiative, which noted it among the 96+ flaws addressed that month. Red Hat promptly issued multiple errata for RHEL 9 and RHEL 10, and Ubuntu issued security notice USN-8740-1 for affected .NET packages. No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond standard patch Tuesday coverage.