CVE-2026-65810 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 31.83%

Affected Products (NVD)

Vendor	Product	Version
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.7.2
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8
microsoft	.net_framework	3.5
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.8.1

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

1607 (x64, x86)	KB5120418
1607 (x64, x86)	KB5120702
1809 (arm64, x64, x86)	KB5120703
1809 (arm64, x64, x86)	KB5120698
21H2 (arm64, x64, x86)	KB5120701
21H2 (arm64, x64, x86)	KB5120709
22H2 (arm64, x64, x86)	KB5120701
22H2 (arm64, x64, x86)	KB5120709

Windows 11

23H2 (arm64, x64)	KB5120713
24H2 (arm64, x64)	KB5120710
25H2 (arm64, x64)	KB5120708
26H1 (arm64, x64)	KB5120711
26H1 (arm64, x64)	KB5120747

Windows Server 2012

Server Core	KB5120699
Server Core	KB5120704
Server Core	KB5120716
Standard	KB5120699
Standard	KB5120704
Standard	KB5120716

Windows Server 2012 R2

Server Core	KB5120695
Server Core	KB5120700
Server Core	KB5120706
Standard	KB5120695
Standard	KB5120700
Standard	KB5120706

Windows Server 2016

Server Core	KB5120418
Server Core	KB5120702
Standard	KB5120418
Standard	KB5120702

Windows Server 2019

Server Core	KB5120698
Server Core	KB5120703
Standard	KB5120698
Standard	KB5120703

Windows Server 2022

Server Core	KB5120705
Server Core	KB5120714
Standard	KB5120705
Standard	KB5120714

Windows Server 2025

Server Core	KB5120708
Standard	KB5120708

Common Weakness Enumeration

CWE-23 - Relative Path Traversal
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65810