Microsoft’s Security Response Center assigns the vulnerability a CVSS base score of 7.8 and a temporal score of 6.8. The complete vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. Microsoft says successful exploitation could give an attacker SYSTEM privileges, making this a high-impact local privilege-escalation issue on affected developer workstations and Windows systems running the affected .NET versions.
The immediate action is to install the relevant .NET servicing update or update Visual Studio to the fixed build. Microsoft’s advisory designates this as a customer-action item.
Publicly disclosed: No
Exploited: No
Customer action required: Yes
The flaw is an integer-overflow privilege escalation
Microsoft describes CVE-2026-62886 as an integer overflow or wraparound vulnerability in .NET. Its exact advisory title is “.NET Elevation of Privilege Vulnerability,” and Microsoft identifies both CWE-122 and CWE-190 for the issue.
The attack is local rather than network-reachable under the CVSS assessment, and the vector records no prerequisite attacker privileges. However, user interaction is required. Microsoft specifically says exploitation requires “that a user trigger the payload in the application.”
That condition should shape how administrators prioritize the remediation. This is not described as a remote service exposure that can be reached unauthenticated over the network. It is a flaw that becomes material when a user can be induced to run or trigger an attacker-controlled payload through an application using an affected .NET environment.
The required user action reduces the number of viable paths to exploitation, but the resulting privilege level raises the stakes. Microsoft’s advisory says that an attacker who successfully exploits the vulnerability could gain SYSTEM privileges. On a Windows endpoint, that is a transition from the security context in which the payload runs to the operating system’s most privileged local context.
Microsoft’s exploitation assessment is Exploitation Less Likely. The advisory’s CVSS temporal score of 6.8, lower than the 7.8 base score, reflects the supplied temporal metrics, including E:U, RL:O, and RC:C.
Affected .NET installations and fixed Windows builds
The Windows remediation is version-specific. Administrators should not treat a general Windows update posture as proof that a machine has received the relevant .NET servicing package; the fixed state is identified here by the installed .NET build.
For .NET 8.0 installed on Windows, Microsoft’s remediation is explicit: install KB5122104 to reach fixed build 8.0.30.
For .NET 9.0 installed on Windows, install KB5122105 to reach fixed build 9.0.19.
For .NET 10.0 installed on Windows, install KB5122106 to reach fixed build 10.0.11.
These are distinct packages and distinct fixed builds. A workstation can have more than one .NET runtime installed, particularly where line-of-business applications, development tools, CI agents, or separate application deployments require different runtime generations. The practical implication is straightforward: the presence of one updated runtime build does not establish remediation for another affected runtime installed on the same Windows machine.
Microsoft’s complete remediation language is: “For .NET 10.0 installed on Windows, install KB5122106 to reach fixed build 10.0.11. For .NET 8.0 installed on Windows, install KB5122104 to reach fixed build 8.0.30. For .NET 9.0 installed on Windows, install KB5122105 to reach fixed build 9.0.19.”
Visual Studio requires its own update path
CVE-2026-62886 also affects two Visual Studio releases. The presence of Visual Studio in the affected-product list matters for development teams because an endpoint may be exposed through the tooling installation even where its application deployment inventory focuses only on runtime servicing.
For Microsoft Visual Studio 2022 version 17.14, Microsoft says to update to fixed build 17.14.38 or later.
For Microsoft Visual Studio 2026 version 18.8, Microsoft says to update to fixed build 18.8.3 or later.
Unlike the affected .NET runtime entries, Microsoft’s supplied product record does not identify a KB number for either Visual Studio entry. The remediation value is the product build: Visual Studio 2022 version 17.14 must reach 17.14.38 or later, and Visual Studio 2026 version 18.8 must reach 18.8.3 or later.
This splits remediation into two operational tracks. Windows and endpoint-management teams need to account for KB5122104, KB5122105, and KB5122106 where the associated .NET versions are installed. Developer-tooling owners need to verify the Visual Studio version and build separately rather than assuming the .NET runtime KBs remediate the IDE installation.
How to prioritize CVE-2026-62886
The CVSS vector identifies local attack access, low attack complexity, no required attacker privileges, required user interaction, unchanged scope, and high impacts to confidentiality, integrity, and availability. Microsoft’s assessment is therefore a useful guide to the risk sequence: exploitation is assessed as less likely, but a successful attack can reach SYSTEM privileges.
For enterprise IT, the meaningful exposure is concentrated on systems where users execute code, open projects, build applications, or otherwise trigger payloads through affected .NET applications. Developer workstations deserve particular attention because both affected runtime versions and Visual Studio installations can coexist there.
For security teams, CVE-2026-62886 belongs in privilege-escalation remediation tracking rather than being dismissed because it needs user interaction. An attacker who already has a foothold in a user context may seek a local escalation route to gain SYSTEM privileges; the advisory describes exactly that potential outcome.
Remediation targets for inventory and deployment
Administrators should match installed products to Microsoft’s fixed-version requirements:
- For .NET 8.0 installed on Windows, install KB5122104 to reach fixed build 8.0.30.
- For .NET 9.0 installed on Windows, install KB5122105 to reach fixed build 9.0.19.
- For .NET 10.0 installed on Windows, install KB5122106 to reach fixed build 10.0.11.
- For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.38 or later.
- For Microsoft Visual Studio 2026 version 18.8, update to fixed build 18.8.3 or later.
The verification point is the fixed build, not simply evidence that a generic patch cycle ran. Systems with .NET 8.0, 9.0, or 10.0 installed on Windows should reach their respective patched builds, while Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.8 should be brought to Microsoft’s stated minimum fixed builds.