CVE-2026-96238: 
Visual Studio 2022 vulnerability analysis and mitigation

CVE-2026-96238 is an Origin Validation Error (CWE-346) in Microsoft .NET that allows an unauthenticated network attacker to bypass a security feature, requiring user interaction to trigger. It was disclosed and patched on October 13, 2026, as part of Microsoft's October 2026 Patch Tuesday release. Affected products include .NET 8.0 (before 8.0.426), .NET 9.0 (before 9.0.122), .NET 10.0 (before 10.0.113), .NET 11.0 (before 11.0.100-rc.2), Microsoft Visual Studio 2022 version 17.14 (before 17.14.42), and Microsoft Visual Studio 2026 version 18.10 (before 18.10.4). The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Microsoft MSRC).

The vulnerability is classified as CWE-346 (Origin Validation Error), meaning the .NET runtime or associated libraries fail to properly validate the origin of a request or resource, allowing an attacker to circumvent security controls. Exploitation occurs over the network and requires user interaction — consistent with scenarios such as a user being tricked into visiting a malicious page or opening a crafted resource that triggers the flawed origin check. The attack complexity is low and no privileges are required on the attacker's side, making it relatively straightforward to exploit once a user interaction vector is established. No public proof-of-concept code has been identified at the time of disclosure (Microsoft MSRC).

Successful exploitation results in a high integrity impact with no confidentiality or availability impact, meaning an attacker can manipulate or tamper with data or security decisions within affected .NET applications without gaining read access to sensitive information or causing service disruption. The scope is unchanged, limiting the blast radius to the vulnerable component itself rather than enabling cross-boundary privilege escalation. Applications relying on .NET's origin validation mechanisms for access control or cross-origin request filtering are most at risk (Microsoft MSRC).

As of the disclosure date, there is no evidence of active in-the-wild exploitation and no public proof-of-concept has been published. The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, further reducing immediate risk (Microsoft MSRC).

Microsoft has released patches for all affected products as part of the October 2026 Patch Tuesday update. Organizations should update to the following fixed versions: .NET 8.0 to 8.0.426 or later, .NET 9.0 to 9.0.122 or later, .NET 10.0 to 10.0.113 or later, .NET 11.0 to 11.0.100-rc.2 or later, Microsoft Visual Studio 2022 version 17.14 to 17.14.42 or later, and Microsoft Visual Studio 2026 version 18.10 to 18.10.4 or later. No configuration-based workarounds have been published; patching is the recommended remediation (Microsoft MSRC).

The vulnerability was noted in coverage of Microsoft's October 2026 Patch Tuesday, which addressed a large number of flaws. Zero Day Initiative included it in their monthly patch review, and BleepingComputer reported on the broader Patch Tuesday release (ZDI Blog, BleepingComputer). No significant independent researcher commentary or social media discussion specific to this CVE has been identified.