CVE-2026-58649

CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.

What to do: Apply Microsoft's September 2026 .NET security updates as part of this month's Patch Tuesday rollout, and check Microsoft's advisory for the exact version ranges that need upgrading. Prioritize internet-facing .NET/ASP.NET applications that perform cross-origin request handling, and review their origin-verification (CORS) configuration as an interim risk reduction. Because exploitation requires user interaction, also treat user-facing lure links as part of the realistic attack path until systems are patched.