All vulnerabilities
CVE-2026-96237

.NET Remote Code Execution Vulnerability

Microsoft .NET 10.0 runtimeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.113Also 8.0.132, 9.0.319 and 2 moreCVE List
Published13 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 10.0.113.NET 10.0 runtimeCVE List
  • 8.0.132.NET 8.0 runtimeCVE List
  • 9.0.319.NET 9.0 runtimeCVE List
  • 17.14.42Microsoft Visual Studio 2022 version 17.14CVE List
  • 18.10.4Microsoft Visual Studio 2026 version 18.10CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

Text from CVE List

Affected versions 5

  • .NET 10.0 runtimeaffected: 10.0.0 before 10.0.113CVE List
  • .NET 8.0 runtimeaffected: 8.0.0 before 8.0.132CVE List
  • .NET 9.0 runtimeaffected: 9.0.0 before 9.0.319CVE List
  • Microsoft Visual Studio 2022 version 17.14affected: 17.14.0 before 17.14.42CVE List
  • Microsoft Visual Studio 2026 version 18.10affected: 18.10.0 before 18.10.4CVE List

References 1