Read the docs
TI-2026-73131 Aliases CVE-2026-96957

Security feature bypass in .NET from improper signature verification

Priority MEDIUM 41CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-347.

Summary

The .NET 10.0 runtime from 10.0.0 before 10.0.402 and the .NET 11.0 runtime from 11.0.0 before 11.0.100-rc.2 are affected, as are Visual Studio 2022 version 17.14 from 17.14.0 before 17.14.42 and Visual Studio 2026 version 18.10 from 18.10.0 before 18.10.4. Improper verification of a cryptographic signature (CWE-347) lets an attacker bypass a security feature. An unauthenticated remote attacker can trigger this over a network, though it requires user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00534 45th percentileScored 2026-11-08
Fix Fixed .NET 10.0 runtime (Microsoft): 10.0.402.NET 11.0 runtime (Microsoft): 11.0.100-rc.2+2 more productsRed Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoft.NET 10.0 runtime10.0.0 to before 10.0.40210.0.402Patch availableCNA
Microsoft.NET 11.0 runtime11.0.0 to before 11.0.100-rc.211.0.100-rc.2Patch availableCNA
MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 to before 17.14.4217.14.42Patch availableCNA
MicrosoftMicrosoft Visual Studio 2026 version 18.1018.10.0 to before 18.10.418.10.4Patch availableCNA
  • .NET 10.0 runtime VendorMicrosoft Affected 10.0.0 to before 10.0.402 Fixed in 10.0.402 Patch available CNA
  • .NET 11.0 runtime VendorMicrosoft Affected 11.0.0 to before 11.0.100-rc.2 Fixed in 11.0.100-rc.2 Patch available CNA
  • Microsoft Visual Studio 2022 version 17.14 VendorMicrosoft Affected 17.14.0 to before 17.14.42 Fixed in 17.14.42 Patch available CNA
  • Microsoft Visual Studio 2026 version 18.10 VendorMicrosoft Affected 18.10.0 to before 18.10.4 Fixed in 18.10.4 Patch available CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*10.0.0 to before 10.0.13VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:*11.0.0 preview1VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:*11.0.0 preview2VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:*11.0.0 preview3VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:*11.0.0 preview4VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:*11.0.0 preview5VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:*11.0.0 preview6VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:*11.0.0 preview7VulnerableMicrosoft
cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:*11.0.0 rc1VulnerableMicrosoft
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
  • cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.13 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview1:*:*:*:*:*:* Versions 11.0.0 preview1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview2:*:*:*:*:*:* Versions 11.0.0 preview2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview3:*:*:*:*:*:* Versions 11.0.0 preview3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview4:*:*:*:*:*:* Versions 11.0.0 preview4 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview5:*:*:*:*:*:* Versions 11.0.0 preview5 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview6:*:*:*:*:*:* Versions 11.0.0 preview6 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:preview7:*:*:*:*:*:* Versions 11.0.0 preview7 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:.net:11.0.0:rc1:*:*:*:*:*:* Versions 11.0.0 rc1 Vulnerable ·Microsoft
  • cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:*17.14.0 to before 17.14.42VulnerableMicrosoft
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:-:*:*18.10.0 to before 18.10.4VulnerableMicrosoft
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:* Versions 17.14.0 to before 17.14.42 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:-:*:* Versions 18.10.0 to before 18.10.4 Vulnerable ·Microsoft

Remediation

Update the .NET 10.0 runtime to 10.0.402, the .NET 11.0 runtime to 11.0.100-rc.2, Visual Studio 2022 version 17.14 to 17.14.42, and Visual Studio 2026 version 18.10 to 18.10.4. Red Hat fixes the .NET 10.0 runtime in RHSA-2026:86193, RHSA-2026:86192 and RHSA-2026:86195, and Red Hat Hardened Images in RHSA-2026:84491.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA .NET 10.0 runtime (Microsoft) Fixed in 10.0.402
  • Fix · CNA .NET 11.0 runtime (Microsoft) Fixed in 11.0.100-rc.2
  • Fix · CNA Microsoft Visual Studio 2022 version 17.14 (Microsoft) Fixed in 17.14.42
  • Fix · CNA Microsoft Visual Studio 2026 version 18.10 (Microsoft) Fixed in 18.10.4

Red Hat 4 advisories

  • RHSA-2026:86193 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) aspnetcore-runtime-10.0-10.0.13-1.el9_8, aspnetcore-runtime-dbg-10.0-10.0.13-1.el9_8, aspnetcore-targeting-pack-10.0-10.0.13-1.el9_8 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el9_8
  • RHSA-2026:86192 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) aspnetcore-runtime-10.0-10.0.13-1.el8_10, aspnetcore-runtime-dbg-10.0-10.0.13-1.el8_10, aspnetcore-targeting-pack-10.0-10.0.13-1.el8_10 +11
    • Red Hat Enterprise Linux CRB (v. 8) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el8_10
  • RHSA-2026:86195 Released 2026-10-20 · Red Hat rating Critical
    .NET 10.0 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 10) aspnetcore-runtime-10.0-10.0.13-1.el10_2, aspnetcore-runtime-dbg-10.0-10.0.13-1.el10_2, aspnetcore-targeting-pack-10.0-10.0.13-1.el10_2 +11
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) dotnet-sdk-10.0-source-built-artifacts-10.0.113-1.el10_2
Show 1 more Red Hat advisories
  • RHSA-2026:84491 Released 2026-10-18 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images dotnet-sdk-10.0-10.0.113-1.hum1@aarch64, dotnet-sdk-10.0-10.0.113-1.hum1@s390x, dotnet-sdk-10.0-10.0.113-1.hum1@x86_64 +12

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:86195
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:86192
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:86193
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:86192
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:86195
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:86193
Red Hat Hardened ImagesFixed RHSA-2026:84491
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-96957
  2. 2026-10-14 CISA SSVC decision points changed
  3. 2026-10-14 Priority changed: LOW → MEDIUM
  4. 2026-10-16 Affected versions changed · Red Hat
  5. 2026-10-16 CVSS score added · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84491 · Red Hat
  7. 2026-10-20 Fix available: Red Hat Hardened Images · Red Hat
  8. 2026-10-21 Fix available: RHSA-2026:86192 · Red Hat
  9. 2026-10-21 Fix available: RHSA-2026:86193 · Red Hat
  10. 2026-10-21 Fix available: RHSA-2026:86195 · Red Hat
  11. 2026-10-21 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) +3 · Red Hat
  12. 2026-10-23 Fix available: Microsoft/.NET 10.0 [email protected], Microsoft/.NET 11.0 [email protected] · CNA

References

Patch 1

  • TI-2026-79288 Buffer overflow in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-19596 .NET and Visual Studio Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2023-19588 Microsoft QUIC Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-14152 .NET and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
See all 129 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences