CVE-2026-96957
8.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-347
Impact
Attackers can bypass security controls to achieve full compromise, data tampering, or denial of service on systems running vulnerable .NET applications. They need network access and user interaction to trigger the malicious payload.
Root cause
The application fails to properly verify cryptographic signatures, accepting spoofed or modified data as authentic.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Check the MSRC advisory for the fixed .NET runtime and SDK releases and apply them; no interim workaround is currently provided.
$ dotnet --infoAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.