CVE-2026-50659: Microsoft .NET and Visual Studio spoofing vulnerability

CVE-2026-50659 · Severity: medium · CVSS 6.5 · Published 2026-07-14

A security vulnerability has been identified in the .NET SMTP client, a component used by developers to send emails from applications. An attacker could exploit this flaw to spoof email messages during the routing process, potentially leading to the delivery of fraudulent communications that appear to come from legitimate sources. Organizations using affected versions of .NET should update their runtime and SDKs to prevent unauthorized message manipulation.

Technologies: Microsoft Visual Studio 2022, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet), Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet), Microsoft.NetCore.App.Runtime.linux-x64 (NuGet), Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet), Microsoft.NetCore.App.Runtime.osx-x64 (NuGet), Microsoft.NetCore.App.Runtime.win-arm (NuGet), Microsoft.NetCore.App.Runtime.win-arm64 (NuGet), Microsoft.NetCore.App.Runtime.win-x64 (NuGet), Microsoft.NetCore.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-50659 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50659 being exploited in the wild.
How severe is CVE-2026-50659?
Medium severity, with a CVSS score of 6.5, published 14 July 2026.
Which products and versions are affected?
Microsoft Visual Studio 2022 17.12.0 to 17.12.22; Microsoft.NetCore.App.Runtime.linux-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet) ECOSYSTEM:introduced=10.0.0,fixed=10.0.10; and 9 more.
Is there a fix for CVE-2026-50659?
Yes. Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.10 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50659 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50659?
Check whether you run Microsoft Visual Studio 2022, Microsoft.NetCore.App.Runtime.linux-arm (NuGet), Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.NetCore.App.Runtime.linux-arm (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-arm --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-musl-arm (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-musl-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-musl-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-musl-x64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.linux-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.linux-x64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.osx-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.osx-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.osx-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.osx-x64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-arm --version 10.0.10
  • Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 10.0.10
  • Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 10.0.10 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 10.0.10

Technical details

A spoofing vulnerability exists in the System.Net.Mail SMTP client implementation within .NET 8, 9, and 10. The root cause is improper encoding or escaping of output (CWE-116), which allows an attacker to manipulate message routing. An attacker with network access and low privileges can exploit this to spoof email communications. The vulnerability affects all platforms and architectures where the vulnerable .NET runtimes are deployed. Microsoft has released patches in versions 8.0.29, 9.0.18, and 10.0.10. Developers must update their .NET SDKs/runtimes and redeploy any self-contained applications.

Affected products

  • Microsoft .NET 8.0.0 - 8.0.28, 9.0.0 - 9.0.17, 10.0.0 - 10.0.9

Identifiers

  • CVE-2026-50659
  • GHSA-74jp-vm22-8q8x

Timeline

  • 2026-07-14: disclosed: Advisory published by Microsoft.
  • 2026-07-20: advisory: GitHub Advisory updated.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.