.NET Security Feature Bypass Vulnerability
Priority MEDIUM 43CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub, Red Hat and Microsoft. Impact type from Microsoft.
Summary
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Fix Fixed System.Security.Cryptography.Xml (NuGet): 10.0.10, 9.0.18, 8.0.4Red Hat: 16 advisoriesMicrosoft: 20 updates
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | .NET 10.0 runtime | 10.0.0 to before 10.0.10 | 10.0.10 | Patch available | CNA |
| Microsoft | .NET 8.0 runtime | 8.0.0 to before 8.0.29 | 8.0.29 | Patch available | CNA |
| Microsoft | .NET 9.0 runtime | 9.0.0 to before 9.0.18 | 9.0.18 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 to before 2.0.50727.8983 & 3.0.30729.8978 | 2.0.50727.8983 & 3.0.30729.8978 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 | 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 | 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | 4.8.1 to before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 | 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 to before 4.7.4143.0 | 4.7.4143.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 to before 4.8.4803.0 | 4.8.4803.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8.1 | 4.8.0.0 to before 4.8.9340.0 | 4.8.9340.0 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | - | — | No fix listed | CNA |
| Microsoft | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | - | — | No fix listed | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.12 | 17.12.0 to before 17.12.22 | 17.12.22 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2022 version 17.14 | 17.14.0 to before 17.14.36 | 17.14.36 | Patch available | CNA |
| Microsoft | Microsoft Visual Studio 2026 version 18.5 | - | — | No fix listed | CNA |
| Microsoft | Microsoft Visual Studio 2026 version 18.7 | 18.0 to before 18.7.4 | 18.7.4 | Patch available | CNA |
| — | System.Security.Cryptography.Xml (NuGet) | 10.0.0 to before 10.0.10 | 10.0.10 | Patch available | GHSA-g8r8-53c2-pm3f |
| — | System.Security.Cryptography.Xml (NuGet) | 9.0.0 to before 9.0.18 | 9.0.18 | Patch available | GHSA-g8r8-53c2-pm3f |
| — | System.Security.Cryptography.Xml (NuGet) | 8.0.0 to before 8.0.4 | 8.0.4 | Patch available | GHSA-g8r8-53c2-pm3f |
- .NET 10.0 runtime VendorMicrosoft Affected 10.0.0 to before 10.0.10 Fixed in 10.0.10 Patch available CNA
- .NET 8.0 runtime VendorMicrosoft Affected 8.0.0 to before 8.0.29 Fixed in 8.0.29 Patch available CNA
- .NET 9.0 runtime VendorMicrosoft Affected 9.0.0 to before 9.0.18 Fixed in 9.0.18 Patch available CNA
- Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before 2.0.50727.8983 & 3.0.30729.8978 Fixed in 2.0.50727.8983 & 3.0.30729.8978 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 Fixed in 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Fixed in 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Fixed in 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 Patch available CNA
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4143.0 Fixed in 4.7.4143.0 Patch available CNA
- Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.4803.0 Fixed in 4.8.4803.0 Patch available CNA
- Microsoft .NET Framework 4.8.1 VendorMicrosoft Affected 4.8.0.0 to before 4.8.9340.0 Fixed in 4.8.9340.0 Patch available CNA
- Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) VendorMicrosoft Affected - Fixed in — No fix listed CNA
- Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) VendorMicrosoft Affected - Fixed in — No fix listed CNA
- Microsoft Visual Studio 2022 version 17.12 VendorMicrosoft Affected 17.12.0 to before 17.12.22 Fixed in 17.12.22 Patch available CNA
- Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.36 Fixed in 17.14.36 Patch available CNA
- Microsoft Visual Studio 2026 version 18.5 VendorMicrosoft Affected - Fixed in — No fix listed CNA
- Microsoft Visual Studio 2026 version 18.7 VendorMicrosoft Affected 18.0 to before 18.7.4 Fixed in 18.7.4 Patch available CNA
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 10.0.0 to before 10.0.10 Fixed in 10.0.10 Patch available GHSA-g8r8-53c2-pm3f
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 9.0.0 to before 9.0.18 Fixed in 9.0.18 Patch available GHSA-g8r8-53c2-pm3f
- System.Security.Cryptography.Xml (NuGet) Vendor— Affected 8.0.0 to before 8.0.4 Fixed in 8.0.4 Patch available GHSA-g8r8-53c2-pm3f
CPE configurations NVD · 43
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* | 4.8.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* | 4.6.2 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
Show 33 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* | 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* | 4.7.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* | 3.5 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:arm64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 8.0.0 to before 8.0.29; 9.0.0 to before 9.0.18 | Vulnerable | Microsoft |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Linux |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* | all versions | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* | all versions | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* | 10.0.0 to before 10.0.6 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* | 15.0 – 15.9 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* | 16.0 – 16.11 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* | 17.12.0 to before 17.12.22; 17.14.0 to before 17.14.36 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:* | 18.7.0 to before 18.7.4 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:visual_studio_2026:18.5.0:*:*:*:*:*:*:* | 18.5.0 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:arm64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.0.29; 9.0.0 to before 9.0.18 Vulnerable ·Microsoft
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x86:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* Versions all versions Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* Versions all versions Running on ·Microsoft
- cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.6 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:* Versions 15.0 – 15.9 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:* Versions 16.0 – 16.11 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:* Versions 17.12.0 to before 17.12.22; 17.14.0 to before 17.14.36 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:* Versions 18.7.0 to before 18.7.4 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:visual_studio_2026:18.5.0:*:*:*:*:*:*:* Versions 18.5.0 Vulnerable ·Microsoft
Remediation
- Fix · GHSA-g8r8-53c2-pm3f System.Security.Cryptography.Xml (NuGet) Fixed in 10.0.10 Advisory →
- Fix · GHSA-g8r8-53c2-pm3f System.Security.Cryptography.Xml (NuGet) Fixed in 9.0.18 Advisory →
- Fix · GHSA-g8r8-53c2-pm3f System.Security.Cryptography.Xml (NuGet) Fixed in 8.0.4 Advisory →
Red Hat 16 advisories
- RHSA-2026:58570 Released 2026-08-24 · Red Hat rating Important.NET 9.0 security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-9.0-source-built-artifacts-9.0.120-1.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-9.0-9.0.19-1.el9_6, aspnetcore-runtime-dbg-9.0-9.0.19-1.el9_6, aspnetcore-targeting-pack-9.0-9.0.19-1.el9_6 +12
- RHSA-2026:58569 Released 2026-08-24 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat CodeReady Linux Builder EUS (v.9.6) dotnet-sdk-8.0-source-built-artifacts-8.0.130-1.el9_6
- Red Hat Enterprise Linux AppStream EUS (v.9.6) aspnetcore-runtime-8.0-8.0.30-1.el9_6, aspnetcore-runtime-dbg-8.0-8.0.30-1.el9_6, aspnetcore-targeting-pack-8.0-8.0.30-1.el9_6 +9
- RHSA-2026:58568 Released 2026-08-24 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream E4S (v.9.4) aspnetcore-runtime-8.0-8.0.30-1.el9_4, aspnetcore-runtime-dbg-8.0-8.0.30-1.el9_4, aspnetcore-targeting-pack-8.0-8.0.30-1.el9_4 +11
Show 13 more Red Hat advisories
- RHSA-2026:58567 Released 2026-08-24 · Red Hat rating Important.NET 9.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-9.0-9.0.19-1.el10_0, aspnetcore-runtime-dbg-9.0-9.0.19-1.el10_0, aspnetcore-targeting-pack-9.0-9.0.19-1.el10_0 +12
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-9.0-source-built-artifacts-9.0.120-1.el10_0
- RHSA-2026:58566 Released 2026-08-24 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) aspnetcore-runtime-8.0-8.0.30-1.el10_0, aspnetcore-runtime-dbg-8.0-8.0.30-1.el10_0, aspnetcore-targeting-pack-8.0-8.0.30-1.el10_0 +9
- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) dotnet-sdk-8.0-source-built-artifacts-8.0.130-1.el10_0
- RHSA-2026:42145 Released 2026-07-20 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images aspnetcore-runtime-8.0-8.0.29-2.1.hum1@aarch64, aspnetcore-runtime-8.0-8.0.29-2.1.hum1@x86_64, aspnetcore-runtime-dbg-8.0-8.0.29-2.1.hum1@aarch64 +22
- RHSA-2026:41898 Released 2026-07-20 · Red Hat rating Important.NET 10.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-10.0-10.0.10-1.el9_8, aspnetcore-runtime-dbg-10.0-10.0.10-1.el9_8, aspnetcore-targeting-pack-10.0-10.0.10-1.el9_8 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el9_8
- RHSA-2026:41896 Released 2026-07-20 · Red Hat rating Important.NET 9.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-9.0-9.0.18-1.el9_8, aspnetcore-runtime-dbg-9.0-9.0.18-1.el9_8, aspnetcore-targeting-pack-9.0-9.0.18-1.el9_8 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el9_8
- RHSA-2026:41894 Released 2026-07-20 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-8.0-8.0.29-1.el9_8, aspnetcore-runtime-dbg-8.0-8.0.29-1.el9_8, aspnetcore-targeting-pack-8.0-8.0.29-1.el9_8 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el9_8
- RHSA-2026:41901 Released 2026-07-20 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-8.0-8.0.29-1.el8_10, aspnetcore-runtime-dbg-8.0-8.0.29-1.el8_10, aspnetcore-targeting-pack-8.0-8.0.29-1.el8_10 +9
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el8_10
- RHSA-2026:41897 Released 2026-07-20 · Red Hat rating Important.NET 10.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-10.0-10.0.10-1.el10_2, aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2, aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el10_2
- RHSA-2026:41900 Released 2026-07-20 · Red Hat rating Important.NET 10.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-10.0-10.0.10-1.el8_10, aspnetcore-runtime-dbg-10.0-10.0.10-1.el8_10, aspnetcore-targeting-pack-10.0-10.0.10-1.el8_10 +12
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-10.0-source-built-artifacts-10.0.110-1.el8_10
- RHSA-2026:41895 Released 2026-07-20 · Red Hat rating Important.NET 9.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-9.0-9.0.18-1.el10_2, aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2, aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2 +11
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el10_2
- RHSA-2026:41893 Released 2026-07-20 · Red Hat rating Important.NET 8.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-8.0-8.0.29-1.el10_2, aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2, aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2 +9
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-8.0-source-built-artifacts-8.0.129-1.el10_2
- RHSA-2026:41899 Released 2026-07-20 · Red Hat rating Important.NET 9.0 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-9.0-9.0.18-1.el8_10, aspnetcore-runtime-dbg-9.0-9.0.18-1.el8_10, aspnetcore-targeting-pack-9.0-9.0.18-1.el8_10 +11
- Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.el8_10
- RHSA-2026:39952 Released 2026-07-15 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images dotnet-sdk-9.0-9.0.119-1.hum1@aarch64, dotnet-sdk-9.0-9.0.119-1.hum1@x86_64, dotnet-sdk-9.0-source-built-artifacts-9.0.119-1.hum1@aarch64 +10
Microsoft 20 updates
- Security Update
- Microsoft .NET Framework 3.5 2.0.50727.9182 & 3.0.30729.9168
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168
- Security Update
- Microsoft .NET Framework 4.8 4.8.4803.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0
Show 17 more Microsoft updates
- Security Update
- Microsoft .NET Framework 4.8 4.8.4803.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
- Security Update
- Microsoft .NET Framework 4.8 4.8.4803.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8 2.0.50727.9182 & 3.0.30729.9168 & 4.8.4803.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 4.8.9340.0
- Microsoft .NET Framework 4.8.1 4.8.9340.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.8.1 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9340.0
- Security Update
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4143.0
- Security Update
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.4143.0
- Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
- Security Update
- Microsoft .NET Framework 3.5 2.0.50727.8983 & 3.0.30729.8978
- Security Update
- Microsoft .NET Framework 3.5 2.0.50727.8983 & 3.0.30729.8978
- Security Update
- Microsoft .NET Framework 3.5 AND 4.7.2 2.0.50727.8983 & 3.0.30729.8978 & 4.7.4143.0
- Windows 10 Version 1607 for 32-bit Systems 10.0.14393.9339
- Windows 10 Version 1607 for x64-based Systems 10.0.14393.9339
- Windows Server 2016 10.0.14393.9339
- Windows Server 2016 (Server Core installation) 10.0.14393.9339
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat CodeReady Linux Builder EUS (v.9.6) | Fixed | RHSA-2026:58569, RHSA-2026:58570 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898 |
| Red Hat Enterprise Linux AppStream E4S (v.9.4) | Fixed | RHSA-2026:58568 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:58566, RHSA-2026:58567 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:58569, RHSA-2026:58570 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) | Fixed | RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898 |
| Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) | Fixed | RHSA-2026:58566, RHSA-2026:58567 |
| Red Hat Hardened Images | Fixed | RHSA-2026:39952, RHSA-2026:42145 |
Not affected: 2 products
- Red Hat Hardened Images
- Red Hat OpenShift Dev Spaces
Microsoft
Microsoft's page for this CVE →
- Impact
- Security Feature Bypass
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
| Product | Status | Plan or fix |
|---|---|---|
| 2 | Affected | No update listed |
| 31 | Affected | No update listed |
| 64 | Affected | No update listed |
| .NET 10.0 installed on Linux | Fixed | 10.0.10 · Security Update |
| .NET 10.0 installed on Mac OS | Fixed | 10.0.10 · Security Update |
| .NET 8.0 installed on Linux | Fixed | 8.0.29 · Security Update |
| .NET 8.0 installed on Mac OS | Fixed | 8.0.29 · Security Update |
| .NET 8.0 installed on Windows | Fixed | 8.0.29 · Security Update |
| .NET 9.0 installed on Linux | Fixed | 9.0.18 · Security Update |
| .NET 9.0 installed on Mac OS | Fixed | 9.0.18 · Security Update |
| .NET 9.0 installed on Windows | Fixed | 9.0.18 · Security Update |
| Microsoft Visual Studio 2022 version 17.12 | Fixed | 17.12.22 · Security Update |
| Microsoft Visual Studio 2022 version 17.14 | Fixed | 17.14.36 · Security Update |
| Microsoft Visual Studio 2026 version 18.7 | Fixed | 18.7.4 · Security Update |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47304
- 2026-10-03 Alias added: GHSA-g8r8-53c2-pm3f
- 2026-10-28 Fix available: Microsoft/.NET 10.0 [email protected], Microsoft/.NET 8.0 [email protected], Microsoft/.NET 9.0 [email protected] · CNA
References
More Microsoft .net vulnerabilities
- TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
- TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-47304 · CVE Program
- CVE-2026-47304 · NVD
- FIRST EPSS
- GHSA-g8r8-53c2-pm3f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-47304 · Microsoft Security Update Guide
- CVE-2026-47304 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences