CVE-2026-108398: .NET Framework Security Feature Bypass Vulnerability
.NET Framework Security Feature Bypass Vulnerability
Other sources
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127689 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127690 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.9363.0Patch KB5127691 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0Patch KB5127694 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127693 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4811.0Patch KB5127688 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4811.0Patch KB5127684 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127692 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0Patch KB5127687 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4150.0Patch KB5127668 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0Patch KB5127683 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.8.4811.0Patch KB5127686 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0Patch KB5127685 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0Patch KB5127666 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.4150.0Patch KB5127667 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0Patch KB5126868
Event History
Frequently Asked Questions
Who is realistically exposed to this vulnerability?
Systems running Microsoft .NET Framework are in scope. Exploitation requires local access by an authorized attacker, so the primary concern is environments where lower-privileged users or processes can execute code locally.
What does an attacker need to exploit it?
The attacker needs local access and existing authorization on the affected system. No user interaction is required according to the provided severity vector.
Does the available information indicate that default configurations are affected?
No. The provided information identifies an untrusted search path issue in .NET Framework but does not state whether it is reachable in a default configuration.
How can I determine whether a system is affected?
Verify whether the system has Microsoft .NET Framework installed. The supplied information does not identify affected versions, fixed versions, or a specific detection method.