CVE-2026-96238: .NET Security Feature Bypass Vulnerability

Overview

Severity

Medium (CVSS 6.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass NuGet Package Source Mapping, a security feature that restricts packages to approved sources. This could cause content from an unauthorized package source to be selected and installed.

Affected Products (14)

Developer Tools

• .NET 9.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 11.0 installed on Windows
• .NET 11.0 installed on Linux
• .NET 11.0 installed on Mac OS
• .NET 8.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• Microsoft Visual Studio 2026 version 18.10
• Microsoft Visual Studio 2022 version 17.14

Security Updates (4)

• 5130035
• Release Notes
• 5130034
• 5130036

Acknowledgments

Raffaello Tamagnini, <a href="https://www.linkedin.com/company/vantage-security-corporation/">Vantage Sec</a>

Revision History

• 2026-10-13: Information published.