Home November 2026 Patch Tuesday CVE-2026-120796 CVE-2026-120796: .NET Denial of Service Vulnerability CVE-2026-120796 is a denial of service vulnerability in .NET, rated Important by Microsoft, with a CVSS 3.1 base score of 5.3 (Medium). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 4 products in 2 product families (Developer Tools, Other).
Key facts CVE ID CVE-2026-120796 Severity Medium CVSS 5.3Microsoft severity Important Impact Denial of Service Exploited in the wild No Publicly disclosed No Exploitation likelihood Less Likely Weakness CWE-407 CISA KEV Not listed Released 10 November 2026 Last updated 11 November 2026 Patch Tuesday November 2026 Patch Tuesday Product families Developer Tools , Other CVSS score and vector Microsoft scores CVE-2026-120796 at 5.3 (temporal 4.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C
Metric Value Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality impact None Integrity impact None Availability impact Low Exploit code maturity Unproven Remediation level Official fix Report confidence Confirmed
Description Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
Affected products (4) Product Security update Type Fixed build Restart .NET 11.0 installed on Windows Release Notes Security Update 11.0.0 .NET 11.0 installed on Linux Release Notes Security Update 11.0.0 .NET 11.0 installed on Mac OS Release Notes Security Update 11.0.0
Other Product Security update Type Fixed build Restart System.Text.Json Release Notes Security Update 11.0.0
NIST NVD data NVD status Awaiting Analysis NVD CVSS 5.3 (MEDIUM) NVD weakness CWE-407 Published to NVD 10 November 2026 NVD last modified 11 November 2026 References Acknowledgments Alejandro Pacheco Artur Stetsko Revision history Version Date Description 1.0 10 November 2026 Information published. 2.0 11 November 2026 Changes made to the security updates links and information. This is an informational change only.
Patch Tuesday archive Data: Microsoft Security Response Center (MSRC) Security Update Guide, CISA Known Exploited Vulnerabilities catalog, FIRST EPSS, NIST National Vulnerability Database, VulnCheck, and public detection rule repositories (Nuclei, Sigma, YARA, Metasploit).
About PatchaPalooza · Feeds: new CVEs · risk changes · advisory updates