.net security

Microsoft’s July 14 .NET servicing release fixes CVE-2026-57108, a network-reachable denial-of-service vulnerability that can let an unauthenticated attacker disrupt a vulnerable application without user interaction. The practical priority is straightforward for Windows administrators and .NET...

Microsoft has fixed CVE-2026-50659, an Important-rated .NET spoofing vulnerability that can let an authenticated attacker manipulate output sent across a network. Developers and administrators should move supported deployments to .NET 8.0.29, .NET 9.0.18, or .NET 10.0.10 and update affected...

Microsoft has patched CVE-2026-50651, a high-severity .NET denial-of-service vulnerability that can be triggered remotely by an unauthenticated attacker. Administrators running .NET-backed network services should move to .NET 8.0.29, .NET 9.0.18, or .NET 10.0.10 and rebuild or redeploy...

Microsoft has patched CVE-2026-50649, a high-severity .NET vulnerability that can allow an attacker to execute code after a victim processes maliciously constructed data. The flaw was disclosed on July 14, 2026, with fixes delivered through .NET 8.0.29, .NET 9.0.18, .NET 10.0.10, updated Visual...

CVE-2026-50648 allows an unauthenticated network attacker to exhaust resources in Microsoft .NET and .NET Framework, potentially knocking an affected application or service offline. Microsoft fixed the high-severity denial-of-service flaw in its July 14, 2026 security releases, making the latest...

CVE-2026-50646 is a high-severity .NET vulnerability that can let an unauthorized attacker execute code on a Windows machine, but Microsoft’s published records disagree on whether administrators should classify it as remote code execution or elevation of privilege. The practical response is less...

CVE-2026-50528 exposes supported .NET applications to a network-reachable authorization bypass, and Microsoft has shipped fixes in .NET 8.0.29, .NET 9.0.18, and .NET 10.0.10 as part of its July 14, 2026 security releases. The flaw carries a CVSS 3.1 base score of 8.2, requires neither...

CVE-2026-50527 exposes supported versions of .NET and .NET Framework to a network-based denial-of-service attack, with Microsoft shipping fixes in its July 14, 2026 security release. The flaw requires no authentication, privileges, or user interaction, making prompt patching particularly...

Microsoft has patched CVE-2026-50526, a high-severity .NET vulnerability that could let a locally authenticated attacker manipulate file operations by exploiting symbolic links or similar filesystem redirections. The flaw carries a CVSS 3.1 score of 7.0 and affects older releases of .NET 8, .NET...

CVE-2026-50525 allows an unauthenticated attacker to remotely exhaust resources in affected .NET installations, potentially making applications or services unavailable. Microsoft addressed the denial-of-service flaw in its July 14, 2026 security updates for .NET 8, .NET 9, .NET 10, and supported...

CVE-2026-47304, an Important-rated .NET security feature bypass, was fixed in Microsoft’s July 14, 2026 security releases for .NET 8, .NET 9, .NET 10, .NET Framework, and supported Visual Studio editions. The flaw carries a CVSS 3.1 score of 8.1 and could let an unauthenticated remote attacker...

Microsoft has patched CVE-2026-50524, a network-reachable denial-of-service vulnerability affecting supported .NET releases and associated Visual Studio installations. The flaw carries a CVSS 3.1 base score of 7.5 and can reportedly be triggered by an unauthenticated attacker without user...

Microsoft published CVE-2026-47303 on July 14, identifying an elevation-of-privilege vulnerability in ASP.NET Core that requires administrators and development teams to review their deployed .NET runtimes, application packages, and container images. The Microsoft Security Response Center posted...

Microsoft lists CVE-2026-45491 as a .NET tampering vulnerability in its Security Update Guide, but the public record available on June 9, 2026, appears thin: the advisory confirms the vulnerability class and vendor acknowledgement while leaving the deeper exploit mechanics largely undisclosed...

Microsoft disclosed CVE-2026-42899 on May 12, 2026, as an Important-rated ASP.NET Core denial-of-service vulnerability caused by an infinite-loop condition, affecting supported .NET 8.0, .NET 9.0, and .NET 10.0 installations across Windows, Linux, and macOS. The bug is not a data-theft story...

Microsoft listed CVE-2026-32177 as a .NET elevation-of-privilege vulnerability in its April 14, 2026 Security Update Guide, affecting supported .NET and Visual Studio servicing channels and carrying a vendor-confirmed vulnerability record rather than a rumor-driven advisory. That last point...

Microsoft’s Security Update Guide entry for CVE-2026-26171 is a reminder that not every .NET vulnerability arrives with a neat exploit narrative. The advisory label says .NET Denial of Service Vulnerability, but the more important signal is Microsoft’s own confidence framing: the company is...

Microsoft has confirmed an information‑disclosure vulnerability affecting .NET, .NET Framework and Visual Studio — tracked as CVE‑2025‑55248 — and published cumulative security updates on October 14, 2025 to address it; public vulnerability trackers rate the flaw as medium (CVSS 3.1 = 4.8) and...

A newly disclosed exploit chain targeting Microsoft SharePoint servers is sending shockwaves across enterprise IT and cybersecurity circles, revealing a sophisticated blend of zero-day and known vulnerabilities that enable cyber attackers to gain near-total control of systems. Security agencies...

A critical vulnerability in DotNetNuke (DNN), catalogued as CVE-2025-52488, has placed the spotlight on the complex interplay of Windows file system operations, .NET behavior, and subtle Unicode normalization pitfalls. Although DNN is recognized for its robust enterprise-ready architecture and...