CVE-2026-109468: ASP.NET Core Denial of Service Vulnerability

For software engineers, DevOps pipelines, and Windows systems administrators maintaining .NET workloads, this vulnerability is a textbook reminder that availability risks often hide inside low-level serialization and framework packages as well as the IDEs that bundle them. While the flaw does not expose confidential data or permit arbitrary code execution, an unauthenticated, network-reachable denial-of-service condition can still knock critical services offline if left unpatched.

Vulnerability Profile and Technical Breakdown​

At the heart of CVE-2026-109468 is weakness CWE-770 (Allocation of Resources Without Limits or Throttling). As recorded in the official advisory fact, ASP.NET Core Denial of Service Vulnerability: Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Microsoft has assigned the vulnerability a CVSS base score of 7.5 and a CVSS temporal score of 6.5, backed by the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C.

Here is the complete official status profile for CVE-2026-109468:

• CVE ID: CVE-2026-109468
• Title: ASP.NET Core Denial of Service Vulnerability
• Severity: Important
• CVSS Base Score: 7.5
• CVSS Temporal Score: 6.5
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-770
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

Deconstructing the CVSS Vector and Practical Risk​

Based on general industry knowledge of the CVSS v3.1 specification, the vector string provides a clear picture of how this vulnerability behaves in production:

• Attack Vector (AV:N) and Attack Complexity (AC:L): The flaw is exploitable over a network without requiring complex timing or specialized conditions.
• Privileges Required (PR:N) and User Interaction (UI:N): An unauthorized attacker does not need valid credentials or any action from an end user or administrator to trigger the resource exhaustion.
• Scope (S:U) and Impact (C:N/I:N/A:H): The impact remains confined to the vulnerable component (Scope: Unchanged), with no direct loss of confidentiality or integrity. However, the availability impact is rated High (A:H), meaning an attacker can fully exhaust the targeted component's resources.
• Temporal Metrics (E:U/RL:O/RC:C): The temporal score drops from 7.5 to 6.5 because exploit code maturity is unproven (E:U), an official remediation level is available (RL:O), and report confidence is confirmed (RC:C).

What makes this advisory particularly important for Windows and .NET teams is how the affected product list spans both IDE installations (Microsoft Visual Studio 2022 version 17.14 and Microsoft Visual Studio 2026 version 18.10) and a standalone library (System.Formats.Cbor, which provides Concise Binary Object Representation read/write functionality in .NET). Even if a workstation updates its Visual Studio build, deployed applications or CI/CD build agents that pull vulnerable versions of System.Formats.Cbor directly must also be updated to ensure the newly compiled binaries carry the patched logic.

Section Summary: CVE-2026-109468 is an Important-severity CWE-770 resource-allocation flaw with a 7.5 base score and 6.5 temporal score. It requires no authentication or user interaction to trigger a denial of service over the network, and customer action is required even though exploitation is currently assessed as less likely.

Affected Products, Fixed Builds, and Remediation​

Microsoft has released fixed builds across the affected Visual Studio branches and the System.Formats.Cbor package. No separate KB article number is assigned to these releases in the MSRC record; remediation is tracked directly by the vendor fixed build numbers below.

To ensure full compliance with the official MSRC remediation summary:

For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.42 or later. For Microsoft Visual Studio 2026 version 18.10, update to fixed build 18.10.4 or later. For System.Formats.Cbor, update to fixed build 10.0.13 or later; update to fixed build 8.0.1 or later; update to fixed build 9.0.21 or later.

Action Plan for Developers and IT Administrators​

Because Customer action required: Yes is explicitly set for CVE-2026-109468, development and operations teams should coordinate both workstation updates and dependency audits:

1. Patch Developer Workstations and Build Servers: Check all machines running Microsoft Visual Studio 2022 version 17.14 and update them to fixed build 17.14.42 or later. Similarly, update all installations of Microsoft Visual Studio 2026 version 18.10 to fixed build 18.10.4 or later.
2. Audit System.Formats.Cbor Dependencies: Inspect project files and package lock files across your repositories for direct or transitive references to System.Formats.Cbor. Depending on the target branch in use, update the package to fixed build 8.0.1 or later, fixed build 9.0.21 or later, or fixed build 10.0.13 or later, and redeploy affected services.

Section Summary: Administrators and developers must update Microsoft Visual Studio 2022 version 17.14 to 17.14.42 or later, update Microsoft Visual Studio 2026 version 18.10 to 18.10.4 or later, and update System.Formats.Cbor to 8.0.1, 9.0.21, or 10.0.13 or later to resolve CVE-2026-109468.