CVE-2026-70162: .NET Denial of Service Vulnerability

Vulnerability Overview and Official Advisory Details​

According to Microsoft's official security advisory, the core issue centers on how .NET handles incoming requests and resource allocation. Specifically, the official advisory states:

.NET Denial of Service Vulnerability: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Click to expand...

Microsoft's official description provides the full operational context for CVE-2026-70162:

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

Click to expand...

Key Vulnerability Metrics and Status​

To help enterprise defenders prioritize their patching schedules, Microsoft has assigned the following ratings and status assessments to CVE-2026-70162:

• CVE ID: CVE-2026-70162
• Title: .NET Denial of Service Vulnerability
• Severity: Important
• CVSS Base Score: 5.9
• CVSS Temporal Score: 5.2
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
• Weakness Classification: CWE-405
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Technical Analysis: CWE-405 and the CVSS Breakdown​

Based on general industry knowledge of the Common Weakness Enumeration and CVSS scoring frameworks, we can unpack why this vulnerability behaves the way it does and what the vector string tells us about the operational risk.

The flaw is categorized under CWE-405, which denotes Asymmetric Resource Consumption (Amplification). In a typical CWE-405 scenario, an adversary expends very little bandwidth or computational effort—such as sending a compact, specially crafted request—to trigger disproportionately heavy processing on the target server. When the Microsoft Common Object Runtime Library processes these malformed or specially structured requests, the resulting amplification can exhaust CPU cycles or memory threads, starving legitimate users and knocking the .NET web application offline.

Looking closely at the CVSS v3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C), several critical factors stand out for enterprise defenders:

1. Network Attack Vector (AV:N) with No Privileges or User Interaction (PR:N/UI:N): The vulnerability is reachable over the network without requiring valid credentials or tricking a user into clicking a link. Any exposed endpoint relying on the vulnerable component is theoretically reachable.
2. High Attack Complexity (AC:H): Successful exploitation is not trivial. It requires conditions beyond the attacker's immediate control or specialized preparation of the crafted requests, which aligns with Microsoft's assessment of Exploitation Less Likely and drops the base score to 5.9.
3. High Availability Impact Only (C:N/I:N/A:H): There is no confidentiality breach (data theft) or integrity loss (data tampering) associated with this flaw. However, the availability impact is rated High, meaning a successful attack can completely halt the affected service.
4. Temporal Modifiers (E:U/RL:O/RC:C): Because functional exploit code is unproven (E:U), an official fix is available (RL:O), and report confidence is confirmed (RC:C), the temporal score scales down to 5.2.

Affected Products, Fixed Builds, and Remediation​

Because System.Security.Cryptography.Pkcs is distributed as a component used across multiple build pipelines and development environments, addressing CVE-2026-70162 requires updating both developer IDEs and application package dependencies.

Complete Remediation Checklist​

To ensure full compliance with the MSRC advisory, administrators and software engineers should execute the exact remediation paths corresponding to their environments:

• For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.42 or later.
• For Microsoft Visual Studio 2026 version 18.10, update to fixed build 18.10.4 or later.
• For System.Security.Cryptography.Pkcs, update to fixed build 10.0.13 or later; update to fixed build 11.0.0-rc.2 or later; update to fixed build 8.0.2 or later; update to fixed build 9.0.21 or later.

Practical Guidance for Windows Administrators and .NET Developers​

Why does a cryptography-related package (System.Security.Cryptography.Pkcs) show up alongside a web request denial-of-service advisory? In enterprise .NET web applications, PKCS (Public-Key Cryptography Standards) cryptographic message syntax is frequently invoked when parsing signed payloads, validating certificates, or handling encrypted tokens submitted via HTTP requests. If an application accepts untrusted input and passes it into an unpatched version of System.Security.Cryptography.Pkcs, it risks triggering the asymmetric resource consumption flaw.

Even if you update Microsoft Visual Studio 2022 version 17.14 to fixed build 17.14.42 or Microsoft Visual Studio 2026 version 18.10 to fixed build 18.10.4 on your developer workstations, compiled web applications already running in production will remain vulnerable until their package references are updated, rebuilt, and redeployed.

1. Audit Your NuGet Dependencies: Search your solution files and dependency graphs for direct or transitive references to System.Security.Cryptography.Pkcs.
2. Apply the Correct Target Build: Depending on which release train your application targets, upgrade System.Security.Cryptography.Pkcs to fixed build 8.0.2, 9.0.21, 10.0.13, or 11.0.0-rc.2 (or later).
3. Update Build Agents and Developer Workstations: Ensure that CI/CD build servers and local machines running Microsoft Visual Studio 2022 version 17.14 or Microsoft Visual Studio 2026 version 18.10 are patched to builds 17.14.42 and 18.10.4 respectively, preventing older library versions from being reintroduced during builds.

Summary​

While CVE-2026-70162 carries an Exploitation Less Likely assessment and has neither been publicly disclosed nor exploited in the wild, unauthenticated network-accessible denial-of-service bugs should never be left lingering on production servers. By updating your Visual Studio installations and bringing System.Security.Cryptography.Pkcs up to its patched builds, you can close off this amplification vector before anyone gets the chance to test your server's limits.