CVE-2026-70194: .NET Framework Security Feature Bypass Vulnerability

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass certificate validation mechanisms and provide arbitrary certificates that do not have proper signatures.

Affected Products (4)

Developer Tools

• Microsoft Visual Studio 2026 version 18.10
• Microsoft Visual Studio 2022 version 17.14
• .NET 11.0 installed on Linux
• .NET 11.0 installed on Mac OS

Security Updates (1)

• Release Notes

Acknowledgments

Kirill Mitrofanov

Revision History

• 2026-10-13: Information published.