This vulnerability, identified as CWE-829, involves the inclusion of functionality from an untrusted control sphere in Microsoft .NET 10.0. This flaw allows an unauthorized attacker to disclose sensitive information over a network without requiring privileges but does require user interaction. The vulnerability has been assigned CVE-2026-62902 and has a CVSS 3.1 base score of 6.5, indicating medium severity. Microsoft has published an official fix for this vulnerability, as detailed in their security advisory.

An unauthorized attacker can exploit this vulnerability to disclose sensitive information over a network. The vulnerability does not allow modification or disruption of availability but impacts confidentiality. User interaction is required for exploitation, and no privileges are needed by the attacker.

An official fix is available from Microsoft. Users and administrators should apply the provided patch from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62902 to remediate this vulnerability.