CVE-2026-96957: .NET Security Feature Bypass Vulnerability
.NET Security Feature Bypass Vulnerability
Other sources
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.10.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.402Patch KB5130036 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.100-rc.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.42
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates network access and low attack complexity, with no privileges required. User interaction is required.
Which environments are explicitly listed as affected?
The listed software includes Microsoft .NET, Visual Studio 2022, Visual Studio 2026, .NET 10.0 on Linux and macOS, and .NET 11.0 on Windows, Linux, and macOS.
Is a mitigation available if patching cannot be done immediately?
The supplied information does not provide a workaround or compensating mitigation.
Is active exploitation known?
The exploit-code maturity is listed as unknown (E:U). The supplied data does not confirm active exploitation.