All vulnerabilities
CVE-2026-108398

.NET Framework Security Feature Bypass Vulnerability

Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploitation reported3 outlets report it, first 13 Oct 2026. Not yet in the KEV catalogReports
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0Also 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0, 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 and 4 moreCVE List
Published13 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2CVE List
  • 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0Microsoft .NET Framework 3.5 AND 4.7.2CVE List
  • 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0Microsoft .NET Framework 3.5 AND 4.8CVE List
  • 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Microsoft .NET Framework 3.5 AND 4.8.1CVE List
  • 4.7.4150.0Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2CVE List
  • 4.8.4811.0Microsoft .NET Framework 4.8CVE List
Show all 7 fixed versions
  • 4.8.9363.0Microsoft .NET Framework 4.8.1CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 13 Oct 2026, 18:59 UTCPublishedCVE List
  2. 13 Oct 2026, 23:24 UTCFirst reported exploitedKrebs on Security
  3. NowNot on CISA's known exploited list yet

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 3

3 outlets report exploitation. Reports are not confirmation; each links to its source.

Description

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

Text from CVE List

Affected versions 7

  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2affected: 3.0.0.0 before 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0CVE List
  • Microsoft .NET Framework 3.5 AND 4.7.2affected: 4.7.0 before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0CVE List
  • Microsoft .NET Framework 3.5 AND 4.8affected: 4.8.0 before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0CVE List
  • Microsoft .NET Framework 3.5 AND 4.8.1affected: 4.8.1 before 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0CVE List
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2affected: 4.7.0 before 4.7.4150.0CVE List
  • Microsoft .NET Framework 4.8affected: 4.8.0 before 4.8.4811.0CVE List
  • Microsoft .NET Framework 4.8.1affected: 4.8.0.0 before 4.8.9363.0CVE List

References 1