Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7cfd54a4c1 advisory.

    Update to .NET SDK 9.0.120 and Runtime 9.0.19

    Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-     62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.19/9.0.120.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.19/9.0.19.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0db5bf0aae advisory.

    Update to .NET SDK 8.0.130 and Runtime 8.0.30

    Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-     62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.30/8.0.130.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.30/8.0.30.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-91c099294a advisory.

    Update to .NET SDK 10.0.111 and Runtime 10.0.11

    Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-     62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.11/10.0.111.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.11/10.0.11.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9c8770dffb advisory.

    Update to .NET SDK 9.0.120 and Runtime 9.0.19

    Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-     62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.19/9.0.120.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.19/9.0.19.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1397d83d94 advisory.

    Update to .NET SDK 8.0.130 and Runtime 8.0.30

    Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-     62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.30/8.0.130.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.30/8.0.30.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8b4cb2340a advisory.

    Update to .NET SDK 10.0.111 and Runtime 10.0.11

    Fixes: CVE-2026-62871,CVE-2026-62886,CVE-2026-62897,CVE-2026-62898,CVE-2026-62899,CVE-2026-62900,CVE-2026-     62901,CVE-2026-62902,CVE-2026-62909,CVE-2026-70354

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.11/10.0.111.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.11/10.0.11.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. (CVE-2026-62871)

  - Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-62901)

  - Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     disclose information over a network. (CVE-2026-62902)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
    (CVE-2026-62898)

Note that Nessus relies on the presence of the package as reported by the vendor.

An update of the dotnet package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
    (CVE-2026-62898)

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by a vulnerability as referenced in the vendor advisory.

  - .NET Elevation of Privilege Vulnerability (CVE-2026-58641, CVE-2026-62871, CVE-2026-62886, CVE-2026-62909)

  - .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

  - .NET Information Disclosure Vulnerability (CVE-2026-62900, CVE-2026-62902)

  - .NET Denial of Service Vulnerability (CVE-2026-62901)

  - .NET Core Remote Code Execution Vulnerability (CVE-2026-70354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - .NET Elevation of Privilege Vulnerability (CVE-2026-58641, CVE-2026-62871, CVE-2026-62886, CVE-2026-62909)

  - .NET Security Feature Bypass Vulnerability (CVE-2026-62899)

  - .NET Information Disclosure Vulnerability (CVE-2026-62900, CVE-2026-62902)

  - .NET Denial of Service Vulnerability (CVE-2026-62901)

  - .NET Core Remote Code Execution Vulnerability (CVE-2026-70354)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
338616	Fedora 44 : dotnet9.0 (2026-7cfd54a4c1)	Nessus	Fedora Local Security Checks	Local	high
338615	Fedora 43 : dotnet8.0 (2026-0db5bf0aae)	Nessus	Fedora Local Security Checks	Local	high
338614	Fedora 43 : dotnet10.0 (2026-91c099294a)	Nessus	Fedora Local Security Checks	Local	high
338613	Fedora 43 : dotnet9.0 (2026-9c8770dffb)	Nessus	Fedora Local Security Checks	Local	high
338612	Fedora 44 : dotnet8.0 (2026-1397d83d94)	Nessus	Fedora Local Security Checks	Local	high
338606	Fedora 44 : dotnet10.0 (2026-8b4cb2340a)	Nessus	Fedora Local Security Checks	Local	high
338059	Microsoft Visual Studio Products (August 2026)	Nessus	Windows : Microsoft Bulletins	Local	high
337807	Linux Distros Unpatched Vulnerability : CVE-2026-62898	Nessus	Misc.	Local	high
337072	Photon OS 5.0: Dotnet PHSA-2026-5.0-92-0961	Nessus	PhotonOS Local Security Checks	Local	critical
445852	SCA: security update for Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86 (GHSA-c494-m2fq-59mx)	Tenable Cloud Security	SCA Checks	Local	high
445852	SCA: security update for Microsoft.NETCore.App.Runtime.win-arm64, Microsoft.NETCore.App.Runtime.win-x64, Microsoft.NETCore.App.Runtime.win-x86 (GHSA-c494-m2fq-59mx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
334621	Security Update for Microsoft .NET Core SDK (August 2026)	Nessus	Windows	Local	high
334610	Security Update for Microsoft .NET Core (August 2026)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2026-62898

high

Tenable Plugins

high

high

high

high

high

high

high

high

critical

high

high

high

high