7.5High

CVE-2026-96237.NET Remote Code Execution Vulnerability

Microsoft .NET 10.0 runtime; Microsoft .NET 8.0 runtime; Microsoft .NET 9.0 runtime; Microsoft Microsoft Visual Studio 2022 version 17.14 Published: 2026-10-13 22:01 (1 month ago)

Description

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

Weakness (CWE): CWE-829

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio 2022 version 17.14	17.14.0 – < 17.14.42
Microsoft	Microsoft Visual Studio 2026 version 18.10	18.10.0 – < 18.10.4
microsoft	.net	8.0.0 – < 8.0.132
Microsoft	.NET 10.0 runtime	10.0.0 – < 10.0.113
Microsoft	.NET 8.0 runtime	8.0.0 – < 8.0.132
Microsoft	.NET 9.0 runtime	9.0.0 – < 9.0.319
microsoft	visual studio 2022	17.14.0 – < 17.14.42

Ubuntu fixes

USN-8942-1 .NET vulnerabilities Ubuntu 26.10, 26.04, 24.04, 22.04 · 20.10.2026 · dotnet10, dotnet11, dotnet8

References and patches

.NET Remote Code Execution Vulnerability vendor-advisorypatch

CVSS score

7.5High

Source: microsoft · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

All scores (2)

cna	CVSS 3.1	7.5High
secure@microsoft.com	CVSS 3.1	7.5High

EPSS (chance of exploitation in 30 days)

0.64%

higher than 51% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2026-09-22
Published2026-10-13 22:01
Reached IP-DB2026-10-24 23:27
Last updated2026-11-10 23:44

Assigned by (CNA): microsoft
NVD status: Awaiting Analysis

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Ubuntu 22.04 LTS

7.7High

CVE-2026-109518 8 days ago

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.8High

CVE-2026-114148 14 days ago

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Unscored

CVE-2026-99095 17 days ago

drm/vc4: drain the hangcheck timer and works on V3D unbind

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: drain the hangcheck timer and works on V3D unbind Nothing stops the hangcheck timer that submitted jobs arm, or the job_done_work that the render-done interrupt queues, at teardown…

Unscored

CVE-2026-99091 17 days ago

Bluetooth: MGMT: Fix status of pending commands flushed on power off

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix status of pending commands flushed on power off cmd_complete_rsp() receives a struct cmd_lookup and, for a pending command that has no cmd_complete callback, falls thro…

Unscored

CVE-2026-99089 17 days ago

ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM The probe function puts the device into the runtime PM active state with only the "iis" bus clock enabled, but it also sets …

Unscored

CVE-2026-99090 17 days ago

drm/amdgpu: serialize vblank counter reads against GPU reset

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblank counter callback reads display registers and scanout position without holding reset_domain->sem. During GPU recovery,…