CVE-2026-96234: .NET Information Disclosure Vulnerability

Overview

Severity
Medium (CVSS 5.3)
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-13

Description

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

FAQ

What type of information could be disclosed by this vulnerability? Exploiting this vulnerability could allow the disclosure of credentials. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.

Affected Products (6)

Developer Tools

  • .NET 10.0 installed on Windows
  • .NET 8.0 installed on Windows
  • .NET 9.0 installed on Windows
  • .NET 11.0 installed on Windows
  • Microsoft Visual Studio 2026 version 18.10
  • Microsoft Visual Studio 2022 version 17.14

Security Updates (4)

Acknowledgments

<a href="https://x.com/ky0tofu">Ky0toFu</a>, nono, <a href="https://www.linkedin.com/in/abdul-rehman---/">Muhammad Abdul Rehman</a>, <a href="https://www.linkedin.com/in/nguyen-hoang-quoc-an-009863267/">kayiz</a> with <a href="http://lp.com.vn/">Lien Phat Technology Corporation</a>, Anonymous, Ali Az, nono, <a href="https://github.com/piropatriot">piropatriot</a>

Revision History

  • 2026-10-13: Information published.