All vulnerabilities
CVE-2026-96957

.NET Security Feature Bypass Vulnerability

Microsoft .NET 10.0 runtimeRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in10.0.402Also 11.0.100-rc.2, 17.14.42 and 1 moreCVE List
Published13 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 10.0.402.NET 10.0 runtimeCVE List
  • 11.0.100-rc.2.NET 11.0 runtimeCVE List
  • 17.14.42Microsoft Visual Studio 2022 version 17.14CVE List
  • 18.10.4Microsoft Visual Studio 2026 version 18.10CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Vendor and government advisories 1

Vendors that say their products are affected, and agencies that issued alerts. Check each for the fixed release of the product you run.

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Text from CVE List

Affected versions 4

  • .NET 10.0 runtimeaffected: 10.0.0 before 10.0.402CVE List
  • .NET 11.0 runtimeaffected: 11.0.0 before 11.0.100-rc.2CVE List
  • Microsoft Visual Studio 2022 version 17.14affected: 17.14.0 before 17.14.42CVE List
  • Microsoft Visual Studio 2026 version 18.10affected: 18.10.0 before 18.10.4CVE List

References 1