The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate     privileges over a network. (CVE-2026-47300)

  - Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-47302)

  - Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate     privileges over a network. (CVE-2026-47303)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Updates for Microsoft Visual Studio Products (July 2026)

critical Nessus Plugin ID 327613

Version 1.5

Version 1.3

Version 1.1

Version 1.5 Jul 27, 2026, 10:22 AM CVSS metrics ("CVSSv2 score" set to 10.0. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C". "CVSSv3 score" set to 9.8. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2026-47300" to "CVE-2026-47304") CVSSv3 score source (changed from "CVE-2026-50526" to none) CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin metadata (Add IAVM Info) Plugin Feed: 202607271022
Version 1.3 Jul 23, 2026, 8:43 AM CVSS metrics ("CVSSv3 score" set to 5.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSSv3 score source (changed from "CVE-2026-47303" to "CVE-2026-50526") CVSSv3 severity (based on CVE-2026-50526, severity decreased from "High" to "Medium") Plugin Feed: 202607230843
Version 1.1 Jul 18, 2026, 3:00 PM New Plugin Feed: 202607181500