{"id":"EUVD-2026-100198","enisaUuid":"403d0d23-307a-3985-8732-cbdb1329bd41","description":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","datePublished":"Oct 13, 2026, 7:01:15 PM","dateUpdated":"Oct 29, 2026, 3:19:17 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83520\n","aliases":"CVE-2026-83520\nGHSA-4w5f-7jp2-w48g\n","assigner":"microsoft","epss":1.44,"enisaIdProduct":[{"id":"07b3b4cd-f278-32a2-a42e-6a4245b1408f","product":{"name":".NET 10.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"10.0.0 \u003c10.0.13"},{"id":"0dab0085-91a5-3d95-b0e9-9c0c679038d7","product":{"name":"Microsoft Visual Studio 2022 version 17.14","vendor":{"name":"Microsoft"}},"product_version":"17.14.0 \u003c17.14.42"},{"id":"189a96ee-fdbd-3f57-ba52-028a34db99c9","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0"},{"id":"18b550e8-22b4-3c08-9d89-8789a4225301","product":{"name":"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2","vendor":{"name":"Microsoft"}},"product_version":"3.0.0.0 \u003c2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0"},{"id":"4d831e70-c9c0-326f-aea9-7da77c98f8c6","product":{"name":"Microsoft .NET Framework 4.8.1","vendor":{"name":"Microsoft"}},"product_version":"4.8.0.0 \u003c4.8.9363.0"},{"id":"66ef95ab-0114-3b59-a324-b17d6d2ffa20","product":{"name":".NET 8.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"8.0.0 \u003c8.0.32"},{"id":"72bcd002-d9c1-3351-9e3b-e9ad440d1de8","product":{"name":"Microsoft Visual Studio 2026 version 18.10","vendor":{"name":"Microsoft"}},"product_version":"18.10.0 \u003c18.10.4"},{"id":"a669a833-bafe-363c-89c4-e6148a869d35","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1","vendor":{"name":"Microsoft"}},"product_version":"4.8.1 \u003c2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0"},{"id":"b1dc5f77-65b0-3836-84e9-7cd39bc5e949","product":{"name":".NET 11.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"11.0.0 \u003c11.0.0-rc.2"},{"id":"d51ceff3-af87-3e8e-b9f5-7f97b89cea2a","product":{"name":"Microsoft .NET Framework 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c4.8.4811.0"},{"id":"d7908370-85d9-33dc-a0cf-923fb7f120ab","product":{"name":".NET 9.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"9.0.0 \u003c9.0.21"},{"id":"e23f00d2-eaa5-3782-b013-115a29f6ba59","product":{"name":"Microsoft .NET Framework 3.5","vendor":{"name":"Microsoft"}},"product_version":"3.5.0 \u003c2.0.50727.9188 AND 3.0.30729.9171"},{"id":"ef1eac9b-10d3-39dd-badc-90747641ab9d","product":{"name":"Microsoft .NET Framework 3.5 AND 4.7.2","vendor":{"name":"Microsoft"}},"product_version":"4.7.0 \u003c2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0"},{"id":"f5ef3afa-88c4-3b07-9032-b002aaaf059e","product":{"name":"Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2","vendor":{"name":"Microsoft"}},"product_version":"4.7.0 \u003c4.7.4150.0"}],"enisaIdVendor":[{"id":"7d0e89b6-79a2-385d-a6c8-21772f8ad824","vendor":{"name":"Microsoft"}}],"enisaIdVulnerability":[{"id":"3971b497-e9c9-3d31-8a56-6d36be6d8048","vulnerability":{"id":"CVE-2026-83520","description":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","datePublished":"Oct 13, 2026, 7:01:15 PM","dateUpdated":"Oct 29, 2026, 3:19:17 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","references":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83520\n","enisa_id":"EUVD-2026-100198\n","assigner":"microsoft","epss":1.44,"dataProcessed":"Oct 30, 2026, 2:00:20 PM","vulnerabilityProduct":[{"id":"2374232d-c34e-3e06-b4eb-6b8181ff7446","product":{"name":"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2","vendor":{"name":"Microsoft"}},"product_version":"3.0.0.0 \u003c2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0"},{"id":"3d2afd92-2314-3e28-8b02-752b4031c0c6","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0"},{"id":"5ed9dfe5-3b6a-3206-a18e-0d3b63a330bb","product":{"name":".NET 10.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"10.0.0 \u003c10.0.13"},{"id":"7b758a13-13f5-3a3c-9002-235e371b568c","product":{"name":".NET 8.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"8.0.0 \u003c8.0.32"},{"id":"940696e5-21f6-3907-887d-5cfa2028d2b1","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1","vendor":{"name":"Microsoft"}},"product_version":"4.8.1 \u003c2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0"},{"id":"96741dd8-5051-3f4c-b4f8-273d9ec6f32d","product":{"name":"Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2","vendor":{"name":"Microsoft"}},"product_version":"4.7.0 \u003c4.7.4150.0"},{"id":"9df00643-a327-3fe0-8fa2-085897ea3674","product":{"name":"Microsoft Visual Studio 2022 version 17.14","vendor":{"name":"Microsoft"}},"product_version":"17.14.0 \u003c17.14.42"},{"id":"b4195afd-b536-3b31-ad36-f532194ae1c8","product":{"name":".NET 9.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"9.0.0 \u003c9.0.21"},{"id":"c7f33b10-3f97-3302-9764-fd3573447c78","product":{"name":"Microsoft .NET Framework 4.8.1","vendor":{"name":"Microsoft"}},"product_version":"4.8.0.0 \u003c4.8.9363.0"},{"id":"c82ca55a-6a8d-3865-bb55-ac16ee3cdf7c","product":{"name":"Microsoft .NET Framework 3.5 AND 4.7.2","vendor":{"name":"Microsoft"}},"product_version":"4.7.0 \u003c2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0"},{"id":"cab3ecfc-5da9-3a93-b8ca-fedea8ff3e3a","product":{"name":"Microsoft .NET Framework 3.5","vendor":{"name":"Microsoft"}},"product_version":"3.5.0 \u003c2.0.50727.9188 AND 3.0.30729.9171"},{"id":"dfe9b419-4f6b-39fb-b47e-c93d0acfd628","product":{"name":"Microsoft .NET Framework 4.8","vendor":{"name":"Microsoft"}},"product_version":"4.8.0 \u003c4.8.4811.0"},{"id":"ef6925f3-0fc2-370b-9934-e455438f84ee","product":{"name":"Microsoft Visual Studio 2026 version 18.10","vendor":{"name":"Microsoft"}},"product_version":"18.10.0 \u003c18.10.4"},{"id":"f1760c41-9b58-332d-8572-babbc9c6eb9a","product":{"name":".NET 11.0 runtime","vendor":{"name":"Microsoft"}},"product_version":"11.0.0 \u003c11.0.0-rc.2"}],"vulnerabilityVendor":[{"id":"938c45f2-986e-3b8f-9741-2588f701e6d8","vendor":{"name":"Microsoft"}}]}},{"id":"d2fb06a8-f1d9-3122-98cd-f676ac60f8b3","vulnerability":{"id":"GHSA-4w5f-7jp2-w48g","description":"Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability","datePublished":"Oct 13, 2026, 8:48:38 PM","dateUpdated":"Oct 19, 2026, 7:18:44 PM","baseScore":0.0,"references":"https://github.com/dotnet/wpf/security/advisories/GHSA-4w5f-7jp2-w48g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-83520\nhttps://github.com/dotnet/announcements/issues/467\nhttps://github.com/dotnet/wpf/issues/12019\nhttps://github.com/dotnet/wpf\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83520\n","enisa_id":"EUVD-2026-100198\n","aliases":"GHSA-4w5f-7jp2-w48g\nCVE-2026-83520\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"7e3c441b-fb74-38de-a267-809bb4f0035a","advisory":{"id":"NCSC-2026-0426","description":"Kwetsbaarheden verholpen in Microsoft Developer Tools","datePublished":"Oct 13, 2026, 6:56:15 PM","dateUpdated":"Oct 13, 2026, 6:56:15 PM","baseScore":0.0,"references":"","aliases":"CVE-2026-58280\nCVE-2026-66822\nCVE-2026-69370\nCVE-2026-69651\nCVE-2026-69905\nCVE-2026-69914\nCVE-2026-69945\nCVE-2026-69969\nCVE-2026-69979\nCVE-2026-70007\nCVE-2026-70035\nCVE-2026-70098\nCVE-2026-70159\nCVE-2026-70161\nCVE-2026-70165\nCVE-2026-70174\nCVE-2026-70175\nCVE-2026-70179\nCVE-2026-70181\nCVE-2026-70183\nCVE-2026-70186\nCVE-2026-70188\nCVE-2026-70190\nCVE-2026-70194\nCVE-2026-70196\nCVE-2026-70197\nCVE-2026-83520\nCVE-2026-84008\nCVE-2026-85363\nCVE-2026-85849\nCVE-2026-85934\nCVE-2026-87697\nCVE-2026-88092\nCVE-2026-96224\nCVE-2026-96225\nCVE-2026-96229\nCVE-2026-96230\nCVE-2026-96231\nCVE-2026-96232\nCVE-2026-96233\nCVE-2026-96234\nCVE-2026-96235\nCVE-2026-96236\nCVE-2026-96237\nCVE-2026-96238\nCVE-2026-96957\nCVE-2026-96958\nCVE-2026-96959\nCVE-2026-96960\nCVE-2026-102229\nCVE-2026-102230\nCVE-2026-102231\nCVE-2026-102232\nCVE-2026-102233\nCVE-2026-102234\nCVE-2026-102235\nCVE-2026-102238\nCVE-2026-102851\nCVE-2026-102870\nCVE-2026-103572\nCVE-2026-108398\nCVE-2026-102869\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"005531e7-2123-31f8-b438-0ba813a5e81e","product":{"name":"System.Security.Cryptography.Xml on .NET 10.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"0064ac93-4282-3977-a400-37c16aa6a97b","product":{"name":"System.Security.Cryptography.Xml on .NET 11.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"03ea5b1b-1b60-3840-a9b5-b119564f7f7f","product":{"name":"System.Security.Cryptography.Xml on .NET 9.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"0b776c4d-a402-3617-81ed-0c9fc9c90678","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022","vendor":{"name":"Microsoft"}}},{"id":"0f4d67d3-0bb5-35e2-9358-8da72f1ac049","product":{"name":".NET 9.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"16744c33-1e0e-30d5-83cc-1ce422b8b4b2","product":{"name":".NET 8.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"20087512-bd98-31c6-838c-06cfab89bc07","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2","vendor":{"name":"Microsoft"}}},{"id":"21cbb928-8e75-3f91-90e5-89c560908f91","product":{"name":"Microsoft .NET Framework 4.8","vendor":{"name":"Microsoft"}}},{"id":"2451a358-e942-3c01-b8cc-82c15519098c","product":{"name":"ASP.NET Core 9.0","vendor":{"name":"Microsoft"}}},{"id":"2466d6de-f2c6-3454-bd37-635747114577","product":{"name":"System.Security.Cryptography.Xml on .NET 10.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"2d5bf7cb-5f2e-3c43-b93b-16e777626121","product":{"name":"Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1","vendor":{"name":"Microsoft"}}},{"id":"3295e98f-d765-3547-a371-7cd55f77d625","product":{"name":".NET 9.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"35ec7e26-eeac-37f8-80b0-3142e2cacf34","product":{"name":".NET 10.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"3cbba94e-9736-3ea4-993f-6e86ac393f21","product":{"name":".NET 10.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"42363be3-3d3a-3219-a3d1-090e931f62dc","product":{"name":"System.Security.Cryptography.Xml on .NET 11.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"49317421-eaa7-3d42-848f-74f38ee5986b","product":{"name":"System.Security.Cryptography.Xml on .NET 11.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"5149b6f8-9fee-37e3-8e94-0ec44f8306ca","product":{"name":"ASP.NET Core 11.0","vendor":{"name":"Microsoft"}}},{"id":"5d6dbd25-6880-34ba-9957-c5dae119e4e3","product":{"name":".NET 10.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"5fa73d10-c28d-34d0-bbfe-852b3983571f","product":{"name":"Azure API Center","vendor":{"name":"Microsoft"}}},{"id":"713375d6-e928-3196-9e12-597cd77d7db0","product":{"name":".NET 11.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"83f100a2-b45e-332f-b841-41bbb7d9270d","product":{"name":"Visual Studio Code","vendor":{"name":"Microsoft"}}},{"id":"8bda8360-f51f-39f5-89f9-28c889b2dee2","product":{"name":"Microsoft Visual Studio 2022 version 17.14","vendor":{"name":"Microsoft"}}},{"id":"8c41968a-941c-363d-9374-b739aa5d1ae8","product":{"name":".NET 11.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"946a6307-d2fb-3d6f-ad7e-64e193953785","product":{"name":"Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025","vendor":{"name":"Microsoft"}}},{"id":"9576dee6-996f-30f0-a420-3279296dfba9","product":{"name":"System.Security.Cryptography.Xml on .NET 9.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"b1347ad5-2716-3bd7-b3a1-5116466c3e09","product":{"name":"Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"c6d33072-e0b4-3313-86c7-5592aec47a75","product":{"name":"ASP.NET Core 8.0","vendor":{"name":"Microsoft"}}},{"id":"d2effc40-e76e-3912-98e8-52a1b0a65068","product":{"name":".NET 9.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"db89200d-4073-300d-90b7-e34369b4f031","product":{"name":"Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"dc78e00e-40f0-3be3-8b60-867bdc135981","product":{"name":"System.Security.Cryptography.Xml on .NET 9.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"e0fbdf1b-c4cf-3dbb-8952-e6ad0fa296fa","product":{"name":"Microsoft.AspNetCore.Components.WebAssembly.Server on .NET 8.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"e927c0a4-8f0f-3cb1-82df-bf3aab3ab8f9","product":{"name":".NET 8.0 installed on Mac OS","vendor":{"name":"Microsoft"}}},{"id":"f00dc48f-8233-3a16-8469-b9edf1fd6b11","product":{"name":"System.Security.Cryptography.Xml on .NET 10.0 installed on Windows","vendor":{"name":"Microsoft"}}},{"id":"fd0603de-fa09-36c2-99a7-22c211b76d80","product":{"name":".NET 11.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"fdb51051-4897-37a6-90b5-7a20e41bd5c3","product":{"name":".NET 8.0 installed on Linux","vendor":{"name":"Microsoft"}}},{"id":"fff151d4-9dc9-3021-b9d4-a8a4ffe89352","product":{"name":"ASP.NET Core 10.0","vendor":{"name":"Microsoft"}}}]}}]}