All vulnerabilities
CVE-2026-96238

.NET Security Feature Bypass Vulnerability

Microsoft .NET 10.0 runtimeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.113Also 11.0.100-rc.2, 8.0.426 and 3 moreCVE List
Published13 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 10.0.113.NET 10.0 runtimeCVE List
  • 11.0.100-rc.2.NET 11.0 runtimeCVE List
  • 8.0.426.NET 8.0 runtimeCVE List
  • 9.0.122.NET 9.0 runtimeCVE List
  • 17.14.42Microsoft Visual Studio 2022 version 17.14CVE List
  • 18.10.4Microsoft Visual Studio 2026 version 18.10CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

Text from CVE List

Affected versions 6

  • .NET 10.0 runtimeaffected: 10.0.0 before 10.0.113CVE List
  • .NET 11.0 runtimeaffected: 11.0.0 before 11.0.100-rc.2CVE List
  • .NET 8.0 runtimeaffected: 8.0.0 before 8.0.426CVE List
  • .NET 9.0 runtimeaffected: 9.0.0 before 9.0.122CVE List
  • Microsoft Visual Studio 2022 version 17.14affected: 17.14.0 before 17.14.42CVE List
  • Microsoft Visual Studio 2026 version 18.10affected: 18.10.0 before 18.10.4CVE List

References 1