Microsoft net vulnerabilities

Latest Microsoft net CVEs

Newest publication first · page 1 of 8

1. CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

   Published 2026-10-22

   Critical·CVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 Exploited in the wild PoC

   A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,...

2. CVE-2026-97801 .NET Framework Tampering Vulnerability

   Published 2026-10-13

   High·CVSS 7.5

   Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.

3. CVE-2026-105016 Microsoft QUIC Remote Code Execution Vulnerability

   Published 2026-10-13

   Critical·CVSS 9.8

   Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

4. CVE-2026-102869 .NET and Visual Studio Elevation of Privilege Vulnerability

   Published 2026-10-13

   High·CVSS 8.8

   Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

5. CVE-2026-58280 .NET Denial of Service Vulnerability

   Published 2026-10-13

   High·CVSS 7.5

   Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

6. CVE-2026-97788 Active Directory Federation Services (AD FS) Information Disclosure Vulnerability

   Published 2026-10-13

   High·CVSS 7.5

   Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

7. CVE-2026-96960 .NET Denial of Service Vulnerability

   Published 2026-10-13

   High·CVSS 7.5

   Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

8. CVE-2026-96959 .NET Denial of Service Vulnerability

   Published 2026-10-13

   High·CVSS 7.5

   Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

9. CVE-2026-96958 .NET Denial of Service Vulnerability

   Published 2026-10-13

   High·CVSS 7.5

   Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

10. CVE-2026-96957 .NET Security Feature Bypass Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

11. CVE-2026-96238 .NET Security Feature Bypass Vulnerability

    Published 2026-10-13

    Medium·CVSS 6.5

    Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

12. CVE-2026-96237 .NET Remote Code Execution Vulnerability

    Published 2026-10-13

    High·CVSS 7.5

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

13. CVE-2026-96235 .NET Remote Code Execution Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

14. CVE-2026-96234 .NET Information Disclosure Vulnerability

    Published 2026-10-13

    Medium·CVSS 5.3

    Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

15. CVE-2026-96233 ASP.NET Core Denial of Service Vulnerability

    Published 2026-10-13

    High·CVSS 7.5

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

16. CVE-2026-96232 .NET Information Disclosure Vulnerability

    Published 2026-10-13

    High·CVSS 7.5

    Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

17. CVE-2026-96231 .NET Elevation of Privilege Vulnerability

    Published 2026-10-13

    High·CVSS 7.8

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

18. CVE-2026-96229 .NET Information Disclosure Vulnerability

    Published 2026-10-13

    Medium·CVSS 6.5

    Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

19. CVE-2026-96225 .NET Elevation of Privilege Vulnerability

    Published 2026-10-13

    High·CVSS 7.8

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

20. CVE-2026-85363 .NET Framework Elevation of Privilege Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

21. CVE-2026-84008 .NET Denial of Service Vulnerability

    Published 2026-10-13

    High·CVSS 7.5

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

22. CVE-2026-83520 .NET Remote Code Execution Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

23. CVE-2026-70035 .NET Framework Remote Code Execution Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

24. CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

25. CVE-2026-96224 .NET Remote Code Execution Vulnerability

    Published 2026-10-13

    High·CVSS 8.8

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.