CVE-2026-83520: .NET Remote Code Execution Vulnerability

Published Oct 13, 2026
·
Updated

.NET Remote Code Execution Vulnerability

Other sources

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

— Microsoft

Affected Software

25 affected componentsFixes available
Microsoft .NET Framework=3.5, =4.8.1
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft .NET Framework=3.5, =4.8
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0
Microsoft Visual Studio 2026=18.10
18.10.4
Microsoft .NET 11.0 installed on Windows<11.0.0-rc.2
11.0.0-rc.2
Microsoft Visual Studio 2022=17.14
17.14.42
Microsoft .NET Framework=4.8
4.8.4811.0
Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2
4.7.4150.0
Microsoft .NET Framework=4.8
4.8.4811.0
Microsoft .NET Framework=4.8
4.8.4811.0
Microsoft .NET 9.0 installed on Windows<9.0.21
9.0.21
Microsoft .NET Framework=3.5, =4.6.2, =4.7, =4.7.1, =4.7.2
2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Microsoft .NET Framework=3.5, =4.7.2
2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Microsoft .NET Framework=3.5, =4.8
2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
Microsoft .NET Framework=4.6.2, =4.7, =4.7.1, =4.7.2
4.7.4150.0
Microsoft .NET Framework=3.5, =4.8
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0
Microsoft .NET Framework=3.5, =4.6.2, =4.7, =4.7.1, =4.7.2
2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Microsoft .NET Framework=3.5
2.0.50727.8987 AND 3.0.30729.8982
Microsoft .NET 8.0 installed on Windows<8.0.32
8.0.32
Microsoft .NET 10.0 installed on Windows<10.0.13
10.0.13
Microsoft .NET Framework=3.5
2.0.50727.9188 AND 3.0.30729.9171
Microsoft .NET Framework=4.8.1
4.8.9363.0
Microsoft .NET Framework=3.5
2.0.50727.8987 AND 3.0.30729.8982
Microsoft .NET Framework=3.5, =4.8.1
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft .NET Framework=3.5, =4.8.1
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0
Microsoft .NET Framework=3.5, =4.8.1
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127690
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0Patch KB5127683
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.10.4
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 11.0.0-rc.2
  5. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.14.42
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.7.4150.0Patch KB5127668
  7. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.8.4811.0Patch KB5127688
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127692
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.8.4811.0Patch KB5127684
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.8.4811.0Patch KB5127686
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0Patch KB5127666
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 9.0.21Patch KB5130035
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0Patch KB5127685
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.7.4150.0Patch KB5127667
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0Patch KB5127687
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0Patch KB5126868
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.8987 AND 3.0.30729.8982Patch KB5127664
  18. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.0.32Patch KB5130034
  19. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171Patch KB5127696
  20. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.13Patch KB5130036
  21. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127693
  22. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.8987 AND 3.0.30729.8982Patch KB5127660
  23. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.8.9363.0Patch KB5127691
  24. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0Patch KB5127694
  25. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0Patch KB5127689

Event History

Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity

Frequently Asked Questions

1

What must an attacker do to exploit this vulnerability?

The attacker can attempt exploitation over a network without prior privileges, but user interaction is required. Exploitation involves untrusted data being deserialized by an affected .NET component.

2

What could a successful exploit allow?

A successful exploit could allow code execution with high impact to confidentiality, integrity, and availability.

3

Which Microsoft products are listed as affected?

The affected software list includes Microsoft .NET Framework; .NET 8.0, 9.0, 10.0, and 11.0 installed on Windows; Visual Studio 2022; and Visual Studio 2026.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203