CVE-2026-62900: 
Visual Studio 2022 vulnerability analysis and mitigation

CVE-2026-62900 is a .NET Information Disclosure vulnerability caused by improper removal of sensitive information before storage or transfer (CWE-212). Specifically, the .NET.Build.Containers component's GitOperations.GetRepositoryUrl function embeds git remote URL credentials (which may include authentication tokens or passwords) into compiled assemblies and PDB files. It affects .NET 8.0 (before 8.0.30), .NET 9.0 (before 9.0.19), .NET 10.0 (before 10.0.11), Visual Studio 2022 version 17.14 (before 17.14.38), and Visual Studio 2026 version 18.8 (before 18.8.3). Disclosed on August 11, 2026, as part of Microsoft's August 2026 Patch Tuesday, it carries a CVSS v3.1 base score of 5.9 (Medium) (Microsoft MSRC, Red Hat Bugzilla).

The root cause is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The GitOperations.GetRepositoryUrl method in the .NET.Build.Containers SDK component fails to strip credentials (e.g., usernames and passwords or tokens embedded in git remote URLs) before writing them into compiled output artifacts such as assemblies (.dll) and program database (.pdb) files. An unauthenticated network attacker who can access these build artifacts — for example, via a public package registry, artifact repository, or container image — could extract the embedded credentials. The attack complexity is rated High, as exploitation requires the attacker to be in a position to obtain and inspect the affected build outputs (Microsoft MSRC, Red Hat Bugzilla).

Successful exploitation results in disclosure of sensitive credentials (git remote URL credentials such as access tokens or passwords) embedded in distributed .NET assemblies or PDB files. This could allow an attacker to gain unauthorized access to source code repositories, CI/CD pipelines, or other systems authenticated via the exposed credentials, potentially enabling lateral movement or supply chain compromise. Confidentiality is the sole impacted dimension — integrity and availability are not affected (Microsoft MSRC, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Microsoft MSRC). The NVD SSVC assessment confirms exploitation is currently "none" and the vulnerability is not automatable. The EPSS score is approximately 0.558%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target artifacts: Locate publicly distributed .NET build artifacts (NuGet packages, container images, or binaries) produced using the affected .NET SDK versions (8.0.0–8.0.29, 9.0.0–9.0.18, or 10.0.0–10.0.10) with the .NET.Build.Containers feature.
2. Download the artifact: Obtain the compiled assembly (.dll) or PDB file from a public registry (e.g., NuGet.org, Docker Hub, or a public artifact repository).
3. Inspect embedded strings: Use a tool such as strings, a .NET decompiler (e.g., ILSpy, dnSpy), or a hex editor to search the binary for git remote URL patterns (e.g., https://user:token@github.com/...).
4. Extract credentials: Parse the embedded URL to retrieve the username and password or access token included in the git remote URL.
5. Leverage credentials: Use the extracted credentials to authenticate to the target git repository or related services, potentially enabling source code access, CI/CD pipeline manipulation, or further lateral movement (Red Hat Bugzilla, Microsoft MSRC).

• File System: Presence of .dll or .pdb files built with affected .NET SDK versions (8.0.0–8.0.29, 9.0.0–9.0.18, 10.0.0–10.0.10) that contain embedded git remote URLs with credentials (detectable via string search for patterns like https://<user>:<token>@).
• Logs: Unexpected authentication events or access to source code repositories using credentials that should only be known to the build system; git server logs showing logins from unfamiliar IP addresses using build-system credentials.
• Network: Outbound connections to git hosting services (e.g., GitHub, GitLab, Azure DevOps) from hosts that are not part of the normal CI/CD pipeline, using credentials matching those embedded in distributed artifacts.

Microsoft released patches on August 11, 2026 (Patch Tuesday). Users should update to the following fixed versions: .NET 8.0.30, .NET 9.0.19, or .NET 10.0.11 depending on their current version; Visual Studio 2022 17.14.38 or later; Visual Studio 2026 18.8.3 or later. Red Hat has issued corresponding errata (RHSA-2026:54538, 54541, 54542, 54550, 54574, 54590, 55856, 55857, 55858) for RHEL 8, 9, and 10. Ubuntu has issued USN-8641-1. As an interim workaround, avoid using credential-embedded git remote URLs in build environments, and audit previously published artifacts for embedded credentials — rotating any exposed tokens or passwords immediately (Microsoft MSRC, Red Hat Bugzilla, .NET Blog).

The vulnerability was covered as part of broader August 2026 Patch Tuesday reporting, with outlets such as BleepingComputer and CyberSecurityNews noting it among approximately 400 vulnerabilities addressed that month. Rapid7 included it in their Patch Tuesday analysis. No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond standard patch cycle coverage (BleepingComputer, Rapid7).