CVE-2026-96237: .NET Remote Code Execution Vulnerability
.NET Remote Code Execution Vulnerability
Other sources
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.113Patch KB5130036 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.319Patch KB5130035 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.132Patch KB5130034
Event History
Frequently Asked Questions
Which environments are identified as affected?
The affected software list includes Microsoft .NET, .NET 8.0 and 9.0 installations on Linux, .NET 8.0 and 10.0 installations on macOS, .NET 9.0 installations on Windows, and Microsoft Visual Studio 2022 and 2026.
What access does an attacker need?
The vector is network-based and no privileges are required. Exploitation requires user interaction and has high attack complexity.
What is the potential impact if exploitation succeeds?
Successful exploitation can affect confidentiality, integrity, and availability at a high level, including remote code execution.