USN-8740-1: .NET vulnerabilities
Ubuntu issued USN-8740-1 fixing two .NET watch flaws, CVE-2026-58649 and CVE-2026-69806, enabling information exposure and privilege escalation.
Ubuntu Security Notice USN-8740-1 addresses two vulnerabilities in .NET watch components. CVE-2026-58649 involves missing cross-origin WebSocket validation in BrowserRefreshServer that could expose sensitive information. CVE-2026-69806 involves improper information exposure through AspireServerService arguments, potentially allowing privilege elevation and arbitrary code execution.
- CVE-2026-58649: missing cross-origin WebSocket validation in BrowserRefreshServer could expose sensitive information.
- CVE-2026-69806: AspireServerService exposes information through arguments, allowing privilege elevation and arbitrary code execution.
- Organizations
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-69806+1 related CVE | Local Privilege Escalation via Sensitive Information Exposure in Microsoft .NET | 7.0 group max | 2% |
From the original article
Weeraphat Srisutham discovered that the . NET watch BrowserRefreshServer did not properly validate cross-origin WebSocket connections. An attacker could possibly use this issue to expose sensitive information.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.