Read the docs
TI-2026-28383 Aliases CVE-2026-39399

NuGet Gallery: Arbitrary Blob Overwrite via Nuspec Confusion and URI Fragment Truncation

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input validation. The issue is exploitable via URI fragment injection using unsanitized package identifiers, allowing an attacker to control the resolved blob path. This enables writes to arbitrary blobs within the storage container, not limited to .nupkg files, resulting in potential tampering of existing content. This issue has been patched in commit 0e80f87628349207cdcaf55358491f8a6f1ca276.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00527 44th percentileScored 2026-11-07
Fix Fixed NuGetGallery (NuGet): 0e80f87628349207cdcaf55358491f8a6f1ca276

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftNuGetGallerybefore 0e80f87628349207cdcaf55358491f8a6f1ca2760e80f87628349207cdcaf55358491f8a6f1ca276Patch availableCNA
  • NuGetGallery VendorMicrosoft Affected before 0e80f87628349207cdcaf55358491f8a6f1ca276 Fixed in 0e80f87628349207cdcaf55358491f8a6f1ca276 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:nugetgallery:*:*:*:*:*:*:*:*——Microsoft
  • cpe:2.3:a:microsoft:nugetgallery:*:*:*:*:*:*:*:* Versions — — ·Microsoft

Remediation

  • Fix · CNA NuGetGallery (NuGet) Fixed in 0e80f87628349207cdcaf55358491f8a6f1ca276

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-39399
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 2

  • TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences