BlackTreeCVE IntelligenceJune 2026 Patch TuesdayMSRC-2026-06-developer-tools-release-notesNormal patch window
Microsoft · MSRC-2026-06-developer-tools-release-notes
Linked CVE review
Deploy Microsoft Developer Tools update for Microsoft Visual Studio 2026 version 18.6
- Linked CVEs
- 1
- Confirmed exploited
- 0
- PoC or lab evidence
- 0
- Maximum CVSS
- 7.5
Confirmed exploitation, public exploit material, EPSS probability and CVSS severity answer different questions. “No confirmation recorded” means the checked sources do not currently confirm exploitation. It is not proof that exploitation has not occurred.
1 of 1 linked CVEs shown
Confirmed exploitedCVSS above 9.0
| CVE and description | Severity | Exploit reality | Forecast and access | Remediation |
|---|---|---|---|---|
CVE-2026-45591 Scheduled assessment ASP.NET Core Denial of Service VulnerabilityA flaw was found in ASP.NET Core SignalR and Blazor Server. A remote attacker could send a specially crafted MessagePack payload containing deeply nested arrays that trigger excessive recursion and cause a stack overflow. This issue may result in application termination and a denial of service condition | 7.5 · CVSS 3.1 · HighSource: CNA | No confirmation recordedNo CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.None recordedNo exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds. | EPSS: 2.44% · 83.8th percentileForecast date: 2026-10-07NETWORK · LOW complexity · NONE privileges · NONE user interaction | Within 7 daysHigh technical severity; prioritise exposed affected systems while verifying vendor guidance.Patch available. RHSA-2026:28007: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) |