CVE-2026-96234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-96234", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2026-09-22T19:05:22.813Z", "datePublished": "2026-10-13T19:01:16.525Z", "dateUpdated": "2026-11-10T20:44:40.490Z"}, "containers": {"cna": {"title": ".NET Information Disclosure Vulnerability", "datePublic": "2026-10-13T14:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.0", "versionEndExcluding": "10.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "8.0.0", "versionEndExcluding": "8.0.32"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.21"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "versionStartIncluding": "11.0.0", "versionEndExcluding": "11.0.0-rc.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.10.0", "versionEndExcluding": "18.10.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.14.0", "versionEndExcluding": "17.14.42"}]}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0 runtime", "versions": [{"version": "10.0.0", "lessThan": "10.0.13", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 runtime", "versions": [{"version": "11.0.0", "lessThan": "11.0.0-rc.2", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 runtime", "versions": [{"version": "8.0.0", "lessThan": "8.0.32", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 runtime", "versions": [{"version": "9.0.0", "lessThan": "9.0.21", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"version": "17.14.0", "lessThan": "17.14.42", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2026 version 18.10", "versions": [{"version": "18.10.0", "lessThan": "18.10.4", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-346: Origin Validation Error", "lang": "en-US", "type": "CWE", "cweId": "CWE-346"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T20:44:40.490Z"}, "references": [{"name": ".NET Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96234"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T19:46:35.424887Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T19:52:10.642Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-96234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T19:46:35.424887Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T19:46:36.206Z"}}], "cna": {"title": ".NET Information Disclosure Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": ".NET 10.0 runtime", "versions": [{"status": "affected", "version": "10.0.0", "lessThan": "10.0.13", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 11.0 runtime", "versions": [{"status": "affected", "version": "11.0.0", "lessThan": "11.0.0-rc.2", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 8.0 runtime", "versions": [{"status": "affected", "version": "8.0.0", "lessThan": "8.0.32", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": ".NET 9.0 runtime", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.21", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2022 version 17.14", "versions": [{"status": "affected", "version": "17.14.0", "lessThan": "17.14.42", "versionType": "custom"}]}, {"vendor": "Microsoft", "product": "Microsoft Visual Studio 2026 version 18.10", "versions": [{"status": "affected", "version": "18.10.0", "lessThan": "18.10.4", "versionType": "custom"}]}], "datePublic": "2026-10-13T14:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96234", "name": ".NET Information Disclosure Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Origin validation error in .NET allows an unauthorized attacker to disclose information over a network."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.13", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "8.0.32", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.21", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "11.0.0-rc.2", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "18.10.4", "versionStartIncluding": "18.10.0"}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.14.42", "versionStartIncluding": "17.14.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-11-10T20:44:40.490Z"}}}, "cveMetadata": {"cveId": "CVE-2026-96234", "state": "PUBLISHED", "dateUpdated": "2026-11-10T20:44:40.490Z", "dateReserved": "2026-09-22T19:05:22.813Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-10-13T19:01:16.525Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": ".NET 10.0 runtime", "vendor": "Microsoft", "versions": [{"lessThan": "10.0.13", "status": "affected", "version": "10.0.0", "versionType": "custom"}]}, {"product": ".NET 11.0 runtime", "vendor": "Microsoft", "versions": [{"lessThan": "11.0.0-rc.2", "status": "affected", "version": "11.0.0", "versionType": "custom"}]}, {"product": ".NET 8.0 runtime", "vendor": "Microsoft", "versions": [{"lessThan": "8.0.32", "status": "affected", "version": "8.0.0", "versionType": "custom"}]}, {"product": ".NET 9.0 runtime", "vendor": "Microsoft", "versions": [{"lessThan": "9.0.21", "status": "affected", "version": "9.0.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2022 version 17.14", "vendor": "Microsoft", "versions": [{"lessThan": "17.14.42", "status": "affected", "version": "17.14.0", "versionType": "custom"}]}, {"product": "Microsoft Visual Studio 2026 version 18.10", "vendor": "Microsoft", "versions": [{"lessThan": "18.10.4", "status": "affected", "version": "18.10.0", "versionType": "custom"}]}], "source": "secure@microsoft.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Origin validation error in .NET allows an unauthorized attacker to disclose information over a network."}], "id": "CVE-2026-96234", "lastModified": "2026-10-22T22:19:56.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "secure@microsoft.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96234", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T19:46:35.424887Z", "version": "2.0.3"}}]}, "published": "2026-10-13T19:21:49.223", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96234"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "secure@microsoft.com", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:84693", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "dotnet8-0-main-8.0.132-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-19T00:00:00Z"}], "bugzilla": {"description": "dotnet: .NET Information Disclosure Vulnerability", "id": "2551106", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2551106"}, "csaw": false, "cwe": "CWE-346", "details": ["Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.", "A flaw was found in .NET. An origin validation error allows an unauthorized remote attacker to disclose sensitive information over the network. Successful exploitation requires user interaction and enables an attacker to access restricted data without proper authorization."], "name": "CVE-2026-96234", "public_date": "2026-10-13T19:01:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-96234\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-96234\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96234"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 10.0 runtime", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.0.0-rc.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 11.0 runtime", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.32)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 8.0 runtime", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.21)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": ".NET 9.0 runtime", "source": "cna", "vendor": "Microsoft"}, "product": ".net", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.10.0,18.10.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Microsoft Visual Studio 2026 version 18.10", "source": "cna", "vendor": "Microsoft"}, "product": "microsoft_visual_studio_2026_version_18.10", "vendor": "microsoft"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.14.0,17.14.42)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Microsoft Visual Studio 2022 version 17.14", "source": "cna", "vendor": "Microsoft"}, "product": "visual_studio_2022", "vendor": "microsoft"}], "created": "2026-10-14T10:45:14.416101+00:00", "updated": "2026-10-24T13:00:13.602378+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$.net", "microsoft$PRODUCT$microsoft_visual_studio_2026_version_18.10", "microsoft$PRODUCT$visual_studio_2022"]}