Information disclosure in Active Directory Federation Services
Priority MEDIUM 40CWE-203Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-203.
Summary
Microsoft Active Directory Federation Services (AD FS) has an observable discrepancy that lets an unauthorized attacker disclose information over a network. The flaw is tracked as CWE-203 and scores 7.5 HIGH under CVSS 3.1, requiring no privileges or user interaction. Affected products include Microsoft .NET Framework 3.5, .NET Framework 4.8.1, Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2 and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00876 59th percentileScored 2026-11-07
Fix Fixed Microsoft .NET Framework 3.5 (Microsoft): 2.0.50727.9188 AND 3.0.30729.9171Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 (Microsoft): 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0+27 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft .NET Framework 3.5 | 3.5.0 to before 2.0.50727.9188 AND 3.0.30729.9171 | 2.0.50727.9188 AND 3.0.30729.9171 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 | 3.0.0.0 to before 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 | 4.7.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8 | 4.8.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 | 4.8.1 to before 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 | 4.7.0 to before 4.7.4150.0 | 4.7.4150.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8 | 4.8.0 to before 4.8.4811.0 | 4.8.4811.0 | Patch available | CNA |
| Microsoft | Microsoft .NET Framework 4.8.1 | 4.8.0.0 to before 4.8.9363.0 | 4.8.9363.0 | Patch available | CNA |
| Microsoft | Windows 10 Version 1607 | 10.0.14393.0 to before 10.0.14393.9612 | 10.0.14393.9612 | Patch available | CNA |
| Microsoft | Windows 10 Version 1809 | 10.0.17763.0 to before 10.0.17763.9376 | 10.0.17763.9376 | Patch available | CNA |
| Microsoft | Windows 10 Version 21H2 | 10.0.19044.0 to before 10.0.19044.7807 | 10.0.19044.7807 | Patch available | CNA |
| Microsoft | Windows 10 Version 22H2 | 10.0.19045.0 to before 10.0.19045.7807 | 10.0.19045.7807 | Patch available | CNA |
| Microsoft | Windows 11 version 23H2 | 10.0.22631.0 to before 10.0.22631.7652 | 10.0.22631.7652 | Patch available | CNA |
| Microsoft | Windows 11 Version 23H2 | 10.0.22631.0 to before 10.0.22631.7652 | 10.0.22631.7652 | Patch available | CNA |
| Microsoft | Windows 11 Version 24H2 | 10.0.26100.0 to before 10.0.26100.9711 | 10.0.26100.9711 | Patch available | CNA |
| Microsoft | Windows 11 Version 25H2 | 10.0.26200.0 to before 10.0.26200.9711 | 10.0.26200.9711 | Patch available | CNA |
| Microsoft | Windows 11 version 26H1 | 10.0.28000.0 to before 10.0.28000.3231 | 10.0.28000.3231 | Patch available | CNA |
| Microsoft | Windows 11 Version 26H2 | 10.0.26300.0 to before 10.0.26300.9711 | 10.0.26300.9711 | Patch available | CNA |
| Microsoft | Windows Server 2012 | 6.2.9200.0 to before 6.2.9200.26434 | 6.2.9200.26434 | Patch available | CNA |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.9200.0 to before 6.2.9200.26434 | 6.2.9200.26434 | Patch available | CNA |
| Microsoft | Windows Server 2012 R2 | 6.3.9600.0 to before 6.3.9600.23470 | 6.3.9600.23470 | Patch available | CNA |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.9600.0 to before 6.3.9600.23470 | 6.3.9600.23470 | Patch available | CNA |
| Microsoft | Windows Server 2016 | 10.0.14393.0 to before 10.0.14393.9612 | 10.0.14393.9612 | Patch available | CNA |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.14393.0 to before 10.0.14393.9612 | 10.0.14393.9612 | Patch available | CNA |
| Microsoft | Windows Server 2019 | 10.0.17763.0 to before 10.0.17763.9376 | 10.0.17763.9376 | Patch available | CNA |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.17763.0 to before 10.0.17763.9376 | 10.0.17763.9376 | Patch available | CNA |
| Microsoft | Windows Server 2022 | 10.0.20348.0 to before 10.0.20348.5761 | 10.0.20348.5761 | Patch available | CNA |
| Microsoft | Windows Server 2025 | 10.0.26100.0 to before 10.0.26100.33650 | 10.0.26100.33650 | Patch available | CNA |
| Microsoft | Windows Server 2025 (Server Core installation) | 10.0.26100.0 to before 10.0.26100.33650 | 10.0.26100.33650 | Patch available | CNA |
- Microsoft .NET Framework 3.5 VendorMicrosoft Affected 3.5.0 to before 2.0.50727.9188 AND 3.0.30729.9171 Fixed in 2.0.50727.9188 AND 3.0.30729.9171 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 3.0.0.0 to before 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.7.2 VendorMicrosoft Affected 4.7.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8 VendorMicrosoft Affected 4.8.0 to before 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 Patch available CNA
- Microsoft .NET Framework 3.5 AND 4.8.1 VendorMicrosoft Affected 4.8.1 to before 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 Patch available CNA
- Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 VendorMicrosoft Affected 4.7.0 to before 4.7.4150.0 Fixed in 4.7.4150.0 Patch available CNA
- Microsoft .NET Framework 4.8 VendorMicrosoft Affected 4.8.0 to before 4.8.4811.0 Fixed in 4.8.4811.0 Patch available CNA
- Microsoft .NET Framework 4.8.1 VendorMicrosoft Affected 4.8.0.0 to before 4.8.9363.0 Fixed in 4.8.9363.0 Patch available CNA
- Windows 10 Version 1607 VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.9612 Fixed in 10.0.14393.9612 Patch available CNA
- Windows 10 Version 1809 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
- Windows 10 Version 21H2 VendorMicrosoft Affected 10.0.19044.0 to before 10.0.19044.7807 Fixed in 10.0.19044.7807 Patch available CNA
- Windows 10 Version 22H2 VendorMicrosoft Affected 10.0.19045.0 to before 10.0.19045.7807 Fixed in 10.0.19045.7807 Patch available CNA
- Windows 11 version 23H2 VendorMicrosoft Affected 10.0.22631.0 to before 10.0.22631.7652 Fixed in 10.0.22631.7652 Patch available CNA
- Windows 11 Version 23H2 VendorMicrosoft Affected 10.0.22631.0 to before 10.0.22631.7652 Fixed in 10.0.22631.7652 Patch available CNA
- Windows 11 Version 24H2 VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.9711 Fixed in 10.0.26100.9711 Patch available CNA
- Windows 11 Version 25H2 VendorMicrosoft Affected 10.0.26200.0 to before 10.0.26200.9711 Fixed in 10.0.26200.9711 Patch available CNA
- Windows 11 version 26H1 VendorMicrosoft Affected 10.0.28000.0 to before 10.0.28000.3231 Fixed in 10.0.28000.3231 Patch available CNA
- Windows 11 Version 26H2 VendorMicrosoft Affected 10.0.26300.0 to before 10.0.26300.9711 Fixed in 10.0.26300.9711 Patch available CNA
- Windows Server 2012 VendorMicrosoft Affected 6.2.9200.0 to before 6.2.9200.26434 Fixed in 6.2.9200.26434 Patch available CNA
- Windows Server 2012 (Server Core installation) VendorMicrosoft Affected 6.2.9200.0 to before 6.2.9200.26434 Fixed in 6.2.9200.26434 Patch available CNA
- Windows Server 2012 R2 VendorMicrosoft Affected 6.3.9600.0 to before 6.3.9600.23470 Fixed in 6.3.9600.23470 Patch available CNA
- Windows Server 2012 R2 (Server Core installation) VendorMicrosoft Affected 6.3.9600.0 to before 6.3.9600.23470 Fixed in 6.3.9600.23470 Patch available CNA
- Windows Server 2016 VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.9612 Fixed in 10.0.14393.9612 Patch available CNA
- Windows Server 2016 (Server Core installation) VendorMicrosoft Affected 10.0.14393.0 to before 10.0.14393.9612 Fixed in 10.0.14393.9612 Patch available CNA
- Windows Server 2019 VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
- Windows Server 2019 (Server Core installation) VendorMicrosoft Affected 10.0.17763.0 to before 10.0.17763.9376 Fixed in 10.0.17763.9376 Patch available CNA
- Windows Server 2022 VendorMicrosoft Affected 10.0.20348.0 to before 10.0.20348.5761 Fixed in 10.0.20348.5761 Patch available CNA
- Windows Server 2025 VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
- Windows Server 2025 (Server Core installation) VendorMicrosoft Affected 10.0.26100.0 to before 10.0.26100.33650 Fixed in 10.0.26100.33650 Patch available CNA
CPE configurations NVD · 48
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* | before 10.0.14393.9612 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* | before 10.0.14393.9612 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* | before 10.0.17763.9376 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* | before 10.0.17763.9376 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* | before 10.0.19044.7807 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* | before 10.0.19044.7807 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* | before 10.0.19044.7807 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* | before 10.0.19045.7807 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* | before 10.0.19045.7807 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* | before 10.0.19045.7807 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* Versions before 10.0.14393.9612 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* Versions before 10.0.14393.9612 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:* Versions before 10.0.19044.7807 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:* Versions before 10.0.19044.7807 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:* Versions before 10.0.19044.7807 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:* Versions before 10.0.19045.7807 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:* Versions before 10.0.19045.7807 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:* Versions before 10.0.19045.7807 Vulnerable ·Microsoft
Show 38 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* | before 10.0.22631.7652 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* | before 10.0.22631.7652 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* | before 10.0.26100.9711 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* | before 10.0.26100.9711 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* | before 10.0.26200.9711 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* | before 10.0.26200.9711 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* | before 10.0.28000.3231 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* | before 10.0.28000.3231 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:* | before 10.0.26300.9711 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:* | before 10.0.26300.9711 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* | before 10.0.14393.9612 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* | before 10.0.17763.9376 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* | before 10.0.20348.5761 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* | before 10.0.26100.33650 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* | 4.8.1 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* | r2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* | 4.6.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* | 4.7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* | 4.7.1 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* | 4.7.2 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* | 3.5 | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_11_26h2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:* Versions before 10.0.22631.7652 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:* Versions before 10.0.22631.7652 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26100.9711 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* Versions before 10.0.26100.9711 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26200.9711 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:* Versions before 10.0.26200.9711 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:* Versions before 10.0.28000.3231 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:* Versions before 10.0.28000.3231 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:* Versions before 10.0.26300.9711 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:* Versions before 10.0.26300.9711 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions before 10.0.14393.9612 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* Versions before 10.0.17763.9376 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* Versions before 10.0.20348.5761 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* Versions before 10.0.26100.33650 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:* Versions 4.8.1 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* Versions 4.7.1 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* Versions 4.7.2 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_11_26h2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
Install the fixed version for each affected product: .NET Framework 3.5 2.0.50727.9188 AND 3.0.30729.9171 (or 2.0.50727.8987 AND 3.0.30729.8982, 2.0.50727.9073 AND 3.0.30729.9070, depending on the branch), .NET Framework 4.8.1 4.8.9363.0, Windows 10 Version 1607 10.0.14393.9612, Windows 10 Version 1809 10.0.17763.9376, Windows 10 Version 21H2 10.0.19044.7807, Windows 11 Version 24H2 10.0.26100.9711 and the other listed builds. The sources list no fixed version for Active Directory Federation Services (AD FS).
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Microsoft .NET Framework 3.5 (Microsoft) Fixed in 2.0.50727.9188 AND 3.0.30729.9171
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.7.2 (Microsoft) Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.8 (Microsoft) Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
- Fix · CNA Microsoft .NET Framework 3.5 AND 4.8.1 (Microsoft) Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
- Fix · CNA Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 (Microsoft) Fixed in 4.7.4150.0
- Fix · CNA Microsoft .NET Framework 4.8 (Microsoft) Fixed in 4.8.4811.0
- Fix · CNA Microsoft .NET Framework 4.8.1 (Microsoft) Fixed in 4.8.9363.0
- Fix · CNA Windows 10 Version 1607 (Microsoft) Fixed in 10.0.14393.9612
- Fix · CNA Windows 10 Version 1809 (Microsoft) Fixed in 10.0.17763.9376
- Fix · CNA Windows 10 Version 21H2 (Microsoft) Fixed in 10.0.19044.7807
- Fix · CNA Windows 10 Version 22H2 (Microsoft) Fixed in 10.0.19045.7807
- Fix · CNA Windows 11 version 23H2 (Microsoft) Fixed in 10.0.22631.7652
- Fix · CNA Windows 11 Version 23H2 (Microsoft) Fixed in 10.0.22631.7652
- Fix · CNA Windows 11 Version 24H2 (Microsoft) Fixed in 10.0.26100.9711
- Fix · CNA Windows 11 Version 25H2 (Microsoft) Fixed in 10.0.26200.9711
- Fix · CNA Windows 11 version 26H1 (Microsoft) Fixed in 10.0.28000.3231
- Fix · CNA Windows 11 Version 26H2 (Microsoft) Fixed in 10.0.26300.9711
- Fix · CNA Windows Server 2012 (Microsoft) Fixed in 6.2.9200.26434
- Fix · CNA Windows Server 2012 (Server Core installation) (Microsoft) Fixed in 6.2.9200.26434
- Fix · CNA Windows Server 2012 R2 (Microsoft) Fixed in 6.3.9600.23470
- Fix · CNA Windows Server 2012 R2 (Server Core installation) (Microsoft) Fixed in 6.3.9600.23470
- Fix · CNA Windows Server 2016 (Microsoft) Fixed in 10.0.14393.9612
- Fix · CNA Windows Server 2016 (Server Core installation) (Microsoft) Fixed in 10.0.14393.9612
- Fix · CNA Windows Server 2019 (Microsoft) Fixed in 10.0.17763.9376
- Fix · CNA Windows Server 2019 (Server Core installation) (Microsoft) Fixed in 10.0.17763.9376
- Fix · CNA Windows Server 2022 (Microsoft) Fixed in 10.0.20348.5761
- Fix · CNA Windows Server 2025 (Microsoft) Fixed in 10.0.26100.33650
- Fix · CNA Windows Server 2025 (Server Core installation) (Microsoft) Fixed in 10.0.26100.33650
Timeline
- 2026-10-13 Threatist record created from CVE-2026-97788
- 2026-10-13 Alias added: GHSA-45q6-m2jc-mwfv
- 2026-10-14 Priority changed: LOW → MEDIUM
- 2026-10-16 Fix available: Microsoft/Windows 10 Version [email protected] · CNA
More Microsoft .net Framework vulnerabilities
- TI-2020-00622 XML injection in Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2 KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01112 A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and… KEVCVSS 3.1HIGH 7.8
- TI-2017-06273 Code injection in Microsoft .NET Framework KEVCVSS 3.1HIGH 7.8
- TI-2015-01495 The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1… KEVCVSS 3.1HIGH 7.8
- TI-2024-19239 .NET Framework Information Disclosure Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2023-18684 ASP.NET Elevation of Privilege Vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2026-97788 · CVE Program
- CVE-2026-97788 · NVD
- FIRST EPSS
- GHSA-45q6-m2jc-mwfv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences