6.5Medium

CVE-2026-70194.NET Framework Security Feature Bypass Vulnerability

Microsoft .NET 11.0 runtime; Microsoft Microsoft Visual Studio 2022 version 17.14; Microsoft Microsoft Visual Studio 2026 version 18.10 Published: 2026-10-13 22:00 (1 month ago)

Description

Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.

Weakness (CWE): CWE-295

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0 – < 17.14.42
Microsoft	Microsoft Visual Studio 2026 version 18.10	18.10.0 – < 18.10.4
microsoft	.net	11.0.0 – < 11.0.0-rc.2
Microsoft	.NET 11.0 runtime	11.0.0 – < 11.0.0-rc.2
microsoft	visual studio 2022	17.14.0 – < 17.14.42

Ubuntu fixes

USN-8942-1 .NET vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 20.10.2026 · dotnet10, dotnet11, dotnet8

References and patches

.NET Framework Security Feature Bypass Vulnerability vendor-advisorypatch

CVSS score

6.5Medium

Source: microsoft · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

All scores (2)

cna	CVSS 3.1	6.5Medium
secure@microsoft.com	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.49%

higher than 42% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: partial

Timeline

ID reserved2026-08-03
Published2026-10-13 22:00
Reached IP-DB2026-10-24 23:36
Last updated2026-11-10 23:39

Assigned by (CNA): microsoft
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Ubuntu 22.04 LTS

High

CVE-2026-106023 4 days ago

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Apache Software Foundation Apache HTTP Server

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Low

CVE-2026-109163 4 days ago

Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Apache Software Foundation Apache HTTP Server

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

8.1High

CVE-2026-119618 4 days ago

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Apache Software Foundation Apache HTTP Server

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from …

1.3%EPSS

7.7High

CVE-2026-109518 11 days ago

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.0High

CVE-2026-84243 16 days ago

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

7.8High

CVE-2026-114148 17 days ago

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.