CVE-2026-96237: .NET Remote Code Execution Vulnerability

Rated Important in severity, this vulnerability stems from how .NET handles external or untrusted functionality. While the prerequisites for pulling off an attack are nontrivial, the potential outcome—unauthorized remote code execution over a network—means development workstations, build servers, and production hosts running .NET 8.0, .NET 9.0, or .NET 10.0 need prompt attention.

Vulnerability Overview and Official Metrics​

At the core of CVE-2026-96237 is a weakness classified under CWE-829: Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network. In practical terms, when a framework or application incorporates code, resources, or functionality from an external domain that it does not strictly control or validate, it risks executing whatever payload resides in that untrusted sphere.

According to Microsoft's official advisory data for CVE-2026-96237 (.NET Remote Code Execution Vulnerability), the vulnerability carries the following formal metrics and status indicators:

• CVE ID: CVE-2026-96237
• Title: .NET Remote Code Execution Vulnerability
• Severity: Important
• CVSS Base Score: 7.5
• CVSS Temporal Score: 6.5
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-829
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes
• Exploitation Assessment: Exploitation Less Likely

Decoding the Technical Risk​

Why does a network-based Remote Code Execution (RCE) vulnerability receive an Important rating and a 7.5 base score rather than a hair-on-fire 9.8? The answer lies directly in the CVSS v3.1 vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.

While the attack vector is network-based (AV:N), requires no prior privileges (PR:N), and can result in a complete loss of confidentiality, integrity, and availability (C:H/I:H/A:H) within an unchanged scope (S:U), two major hurdles stand in an attacker's way:

1. High Attack Complexity (AC:H): Microsoft's official advisory specifically addresses this metric: "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment." An attacker cannot simply fire a packet at a default web port and expect a shell; the target environment must first be conditioned or prepared for the untrusted functionality to be included.
2. User Interaction Required (UI:R): A valid user—often a developer opening a project, running a build, or interacting with a compromised resource—must take an action to trigger the flaw.

Because of these constraints, combined with the fact that the flaw is neither publicly disclosed nor actively exploited (E:U), Microsoft assesses the risk as Exploitation Less Likely, and the official remediation level (RL:O) brings the temporal score down to 6.5. Still, in modern CI/CD environments and enterprise developer networks where external packages, templates, and build configurations move rapidly, leaving an AC:H RCE unpatched is a gamble no security team needs to take.

Affected Products and Remediation Matrix​

Because .NET is a cross-platform ecosystem, the patching scope spans every major operating system where the .NET runtime is deployed, as well as the Windows-based Visual Studio IDEs that bundle these toolchains.

Below is the complete table of affected products, knowledge base (KB) articles, and vendor fixed builds required to resolve CVE-2026-96237:

Actionable Guidance for Administrators and Developers​

Because Customer action required: Yes is explicitly set for this advisory, organizations should verify that both server-side runtimes and client-side developer workstations receive the appropriate updates:

• Update .NET 10.0 Environments: Across Windows, Mac OS, and Linux hosts, deploy KB5130036 to bring the runtime to fixed build 10.0.113.
• Update .NET 9.0 Environments: Across Windows, Mac OS, and Linux hosts, deploy KB5130035 to bring the runtime to fixed build 9.0.319.
• Update .NET 8.0 Environments: Across Windows, Mac OS, and Linux hosts, deploy KB5130034 to bring the runtime to fixed build 8.0.132.
• Patch Visual Studio Installations: Developers using Microsoft Visual Studio 2022 version 17.14 must update to fixed build 17.14.42 or later, and those running Microsoft Visual Studio 2026 version 18.10 must update to fixed build 18.10.4 or later.

Don't forget to audit self-contained .NET deployments and container base images in your DevOps pipelines—if an image or bundled application packages an older build of the .NET 8.0, 9.0, or 10.0 runtime, rebuilding and redeploying against builds 8.0.132, 9.0.319, or 10.0.113 is the surest way to close the door on CVE-2026-96237.