High severity7.0NVD Advisory· Published Sep 8, 2026· Updated Sep 29, 2026
CVE-2026-69806
CVE-2026-69806
Description
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally.
Affected products
42cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*range: >=9.0.0,<9.0.20
- cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*
- cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*
- (no CPE)
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*range: >=17.14.0,<17.14.40
- cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*range: >=18.9.0,<18.9.3
- osv-coords31 versionspkg:bitnami/dotnetpkg:bitnami/dotnet-sdkpkg:rpm/almalinux/aspnetcore-runtime-10.0pkg:rpm/almalinux/aspnetcore-runtime-9.0pkg:rpm/almalinux/aspnetcore-runtime-dbg-10.0pkg:rpm/almalinux/aspnetcore-runtime-dbg-9.0pkg:rpm/almalinux/aspnetcore-targeting-pack-10.0pkg:rpm/almalinux/aspnetcore-targeting-pack-9.0pkg:rpm/almalinux/dotnetpkg:rpm/almalinux/dotnet-apphost-pack-10.0pkg:rpm/almalinux/dotnet-apphost-pack-9.0pkg:rpm/almalinux/dotnet-hostpkg:rpm/almalinux/dotnet-hostfxr-10.0pkg:rpm/almalinux/dotnet-hostfxr-9.0pkg:rpm/almalinux/dotnet-runtime-10.0pkg:rpm/almalinux/dotnet-runtime-9.0pkg:rpm/almalinux/dotnet-runtime-dbg-10.0pkg:rpm/almalinux/dotnet-runtime-dbg-9.0pkg:rpm/almalinux/dotnet-sdk-10.0pkg:rpm/almalinux/dotnet-sdk-10.0-source-built-artifactspkg:rpm/almalinux/dotnet-sdk-9.0pkg:rpm/almalinux/dotnet-sdk-9.0-source-built-artifactspkg:rpm/almalinux/dotnet-sdk-aot-10.0pkg:rpm/almalinux/dotnet-sdk-aot-9.0pkg:rpm/almalinux/dotnet-sdk-dbg-10.0pkg:rpm/almalinux/dotnet-sdk-dbg-9.0pkg:rpm/almalinux/dotnet-targeting-pack-10.0pkg:rpm/almalinux/dotnet-targeting-pack-9.0pkg:rpm/almalinux/dotnet-templates-10.0pkg:rpm/almalinux/dotnet-templates-9.0pkg:rpm/almalinux/netstandard-targeting-pack-2.1
>= 9.0.0, < 9.0.20+ 30 more
- (no CPE)range: >= 9.0.0, < 9.0.20
- (no CPE)range: >= 9.0.0, < 9.0.20
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.112-1.el8_10
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.112-1.el10_2
- (no CPE)range: < 10.0.112-1.el10_2
- (no CPE)range: < 9.0.121-1.el10_2
- (no CPE)range: < 9.0.121-1.el10_2
- (no CPE)range: < 10.0.112-1.el10_2
- (no CPE)range: < 9.0.121-1.el10_2
- (no CPE)range: < 10.0.112-1.el10_2
- (no CPE)range: < 9.0.121-1.el10_2
- (no CPE)range: < 10.0.12-1.el10_2
- (no CPE)range: < 9.0.20-1.el10_2
- (no CPE)range: < 10.0.112-1.el10_2
- (no CPE)range: < 9.0.121-1.el10_2
- (no CPE)range: < 9.0.121-1.el10_2
Patches
Vulnerability mechanics
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69806nvdVendor AdvisoryPatch
News mentions
2- Patch Tuesday - September 2026Rapid7 Blog · Sep 8, 2026
- Massive Microsoft Patch Tuesday September 2026 – 973 Vulnerabilities Fixed, Including 2 Zero-DaysCyber Security News · Sep 8, 2026