CVE-2026-70162

.NET Denial of Service Vulnerability

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Redhat

Products

Microsoft Visual Studio 2026 Version 18.10 System.security.cryptography.pkcs Visual Studio 2022 and 1 more

CVE-2026-96234

.NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft Redhat

Products

.net Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 and 1 more

CVE-2026-96230

ASP.NET Core Remote Code Execution Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft.aspnetcore.components.webassembly.server Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-96236

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-83520

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-88092

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022 and 1 more

CVE-2026-70188

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70190

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70196

ASP.NET Core Denial of Service Vulnerability

Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70186

ASP.NET Core Denial of Service Vulnerability

Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-103572

Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70183

ASP.NET Core Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70159

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Microsoft.aspnetcore.signalr.common Microsoft.aspnetcore.signalr.core Microsoft Visual Studio 2026 Version 18.10 and 1 more

CVE-2026-70179

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Microsoft.aspnetcore.authentication.negotiate Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-70181

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Asp.net Core Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2026-96232

.NET Information Disclosure Vulnerability

Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Microsoft Visual Studio 2026 Version 18.10 Visual Studio 2022

CVE-2022-21986

.NET Denial of Service Vulnerability

.NET Denial of Service Vulnerability

CVSS 3.1 · 7.5 High EPSS 3.6% KEV · Not listed

Vendors

Fedoraproject Microsoft Redhat

Products

Fedora .net Visual Studio 2019 and 3 more

CVE-2023-32028

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft SQL OLE DB Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Ole Db Driver 18 For Sql Server Ole Db Driver 19 For Sql Server Ole Db Driver For Sql Server and 4 more

CVE-2026-58649

.NET Information Disclosure Vulnerability

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 6 more

CVE-2026-69304

ASP.NET Core Denial of Service Vulnerability

Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net Asp.net Core Microsoft Visual Studio 2022 and 4 more