Read the docs
TI-2018-00727 Aliases CVE-2018-0786GHSA-jc8g-xhw5-6x46

Improper certificate validation in Microsoft .NET Framework, .NET Core, and PowerShell…

Priority LOW 39CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."

Why it matters now

EPSS 0.03687 89th percentileScored 2026-11-07
Fix Fixed Microsoft.NETCore.UniversalWindowsPlatform (NuGet): 5.2.4, 5.3.5, 5.4.2 +1System.ServiceModel.Primitives (NuGet): 4.4.1, 4.3.1, 4.1.1+5 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoft.NET Framework, .NET Core, and PowerShell CoreMicrosoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, PowerShell Core 6.0.0—No fix listedCNA
—Microsoft.NETCore.UniversalWindowsPlatform (NuGet)5.2.0 to before 5.2.45.2.4Patch availableGHSA-jc8g-xhw5-6x46
—Microsoft.NETCore.UniversalWindowsPlatform (NuGet)5.3.0 to before 5.3.55.3.5Patch availableGHSA-jc8g-xhw5-6x46
—Microsoft.NETCore.UniversalWindowsPlatform (NuGet)5.4.0 to before 5.4.25.4.2Patch availableGHSA-jc8g-xhw5-6x46
—Microsoft.NETCore.UniversalWindowsPlatform (NuGet)6.0.0 to before 6.0.66.0.6Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Primitives (NuGet)4.4.0 to before 4.4.14.4.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Primitives (NuGet)4.3.0 to before 4.3.14.3.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Primitives (NuGet)4.1.0 to before 4.1.14.1.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Http (NuGet)4.4.0 to before 4.4.14.4.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Http (NuGet)4.3.0 to before 4.3.14.3.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Http (NuGet)4.1.0 to before 4.1.14.1.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.NetTcp (NuGet)4.4.0 to before 4.4.14.4.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.NetTcp (NuGet)4.3.0 to before 4.3.14.3.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.NetTcp (NuGet)4.1.0 to before 4.1.14.1.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Duplex (NuGet)4.4.0 to before 4.4.14.4.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Duplex (NuGet)4.3.0 to before 4.3.14.3.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Duplex (NuGet)4.0.1 to before 4.0.24.0.2Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Security (NuGet)4.4.0 to before 4.4.14.4.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Security (NuGet)4.3.0 to before 4.3.14.3.1Patch availableGHSA-jc8g-xhw5-6x46
—System.ServiceModel.Security (NuGet)4.0.1 to before 4.0.24.0.2Patch availableGHSA-jc8g-xhw5-6x46
—System.Private.ServiceModel (NuGet)4.4.0 to before 4.4.14.4.1Patch availableGHSA-jc8g-xhw5-6x46
—System.Private.ServiceModel (NuGet)4.3.0 to before 4.3.14.3.1Patch availableGHSA-jc8g-xhw5-6x46
—System.Private.ServiceModel (NuGet)4.1.0 to before 4.1.14.1.1Patch availableGHSA-jc8g-xhw5-6x46
  • .NET Framework, .NET Core, and PowerShell Core VendorMicrosoft Affected Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, PowerShell Core 6.0.0 Fixed in — No fix listed CNA
  • Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Vendor— Affected 5.2.0 to before 5.2.4 Fixed in 5.2.4 Patch available GHSA-jc8g-xhw5-6x46
  • Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Vendor— Affected 5.3.0 to before 5.3.5 Fixed in 5.3.5 Patch available GHSA-jc8g-xhw5-6x46
  • Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Vendor— Affected 5.4.0 to before 5.4.2 Fixed in 5.4.2 Patch available GHSA-jc8g-xhw5-6x46
  • Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Vendor— Affected 6.0.0 to before 6.0.6 Fixed in 6.0.6 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Primitives (NuGet) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Primitives (NuGet) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Primitives (NuGet) Vendor— Affected 4.1.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Http (NuGet) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Http (NuGet) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Http (NuGet) Vendor— Affected 4.1.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.NetTcp (NuGet) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.NetTcp (NuGet) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.NetTcp (NuGet) Vendor— Affected 4.1.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Duplex (NuGet) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Duplex (NuGet) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Duplex (NuGet) Vendor— Affected 4.0.1 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Security (NuGet) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Security (NuGet) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.ServiceModel.Security (NuGet) Vendor— Affected 4.0.1 to before 4.0.2 Fixed in 4.0.2 Patch available GHSA-jc8g-xhw5-6x46
  • System.Private.ServiceModel (NuGet) Vendor— Affected 4.4.0 to before 4.4.1 Fixed in 4.4.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.Private.ServiceModel (NuGet) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-jc8g-xhw5-6x46
  • System.Private.ServiceModel (NuGet) Vendor— Affected 4.1.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-jc8g-xhw5-6x46

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net_core:1.0:*:*:*:*:*:*:*1.0VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_core:2.0:*:*:*:*:*:*:*2.0VulnerableMicrosoft
cpe:2.3:a:microsoft:powershell_core:6.0:*:*:*:*:*:*:*6.0VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*2.0 sp2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*3.0 sp2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*3.5VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*1511Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*1607Running onMicrosoft
  • cpe:2.3:a:microsoft:.net_core:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_core:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:powershell_core:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* Versions 2.0 sp2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* Versions 3.0 sp2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709Running onMicrosoft
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*3.5.1VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*r2 sp1Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*r2 sp1Running onMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*4.5.2VulnerableMicrosoft
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*4.6VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*4.6.1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*4.6.2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*4.7VulnerableMicrosoft
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*4.7.1VulnerableMicrosoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:* Versions r2 sp1 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* Versions r2 sp1 Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* Versions 4.5.2 Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* Versions 4.6.1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft

Remediation

  • Fix · GHSA-jc8g-xhw5-6x46 Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Fixed in 5.2.4 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Fixed in 5.3.5 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Fixed in 5.4.2 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 Microsoft.NETCore.UniversalWindowsPlatform (NuGet) Fixed in 6.0.6 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Primitives (NuGet) Fixed in 4.4.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Primitives (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Primitives (NuGet) Fixed in 4.1.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Http (NuGet) Fixed in 4.4.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Http (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Http (NuGet) Fixed in 4.1.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.NetTcp (NuGet) Fixed in 4.4.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.NetTcp (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.NetTcp (NuGet) Fixed in 4.1.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Duplex (NuGet) Fixed in 4.4.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Duplex (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Duplex (NuGet) Fixed in 4.0.2 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Security (NuGet) Fixed in 4.4.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Security (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.ServiceModel.Security (NuGet) Fixed in 4.0.2 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.Private.ServiceModel (NuGet) Fixed in 4.4.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.Private.ServiceModel (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-jc8g-xhw5-6x46 System.Private.ServiceModel (NuGet) Fixed in 4.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • .NET Core 1.0 on Red Hat Enterprise Linux
  • .NET Core 1.1 on Red Hat Enterprise Linux
  • .NET Core 2.0 on Red Hat Enterprise Linux

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-0786
  2. 2026-10-03 Alias added: GHSA-jc8g-xhw5-6x46

References

Patch 1

Advisory 2

Other 3

  • TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
  • TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-00583 Improper input validation in Microsoft .NET Core CVSS 3.1HIGH 8.8
  • TI-2020-00582 Improper input validation in Microsoft .NET Core CVSS 3.1HIGH 8.8
  • TI-2021-06407 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-11690 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences