.NET vulnerabilities and fixes

CVEs that mention .NET, ranked by priority. 26 tracked.

.NET has 26 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 26. Most recent: 2026-10-15. Highest priority: CVE-2026-70035 (score 53/100).

• CVE-2026-70035 HIGH 8.8 Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a net
• CVE-2026-70159 HIGH 7.5 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s
• CVE-2026-96958 HIGH 7.5 UPGRADE DOWNGRADE Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96960 HIGH 7.5 UPGRADE DOWNGRADE Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a
• CVE-2026-102870 HIGH 8.8 Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to e
• CVE-2026-96230 HIGH 8.8 Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an
• CVE-2026-96233 HIGH 7.5 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-96959 HIGH 7.5 UPGRADE DOWNGRADE Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service o
• CVE-2026-109468 HIGH 7.5 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s
• CVE-2026-85363 HIGH 8.8 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a
• CVE-2026-70007 HIGH 8.8 Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
• CVE-2026-13181 HIGH 8.1 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeNa
• CVE-2026-13186 HIGH 8.1 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persi
• CVE-2026-13185 HIGH 8.1 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersiste
• CVE-2026-13190 HIGH 8.1 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence uti
• CVE-2026-70179 HIGH 7.5 Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a n
• CVE-2026-13182 HIGH 7.5 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish
• CVE-2026-13183 HIGH 7.5 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cry
• CVE-2026-70194 MEDIUM 6.5 Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature
• CVE-2026-13187 HIGH 8.1 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with
• CVE-2026-13189 HIGH 7.5 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in t
• CVE-2026-13184 HIGH 7.5 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and
• CVE-2026-14932 MEDIUM 6.5 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handl
• CVE-2026-14865 MEDIUM 5.3 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-st
• CVE-2026-13192 MEDIUM 6.5 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the Ra
• CVE-2026-13188 MEDIUM 5.9 UPGRADE In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with,

FAQ

How do I fix .NET vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is .NET being exploited right now?

None of the tracked .NET CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which .NET CVE should I patch first?

CVE-2026-70035 currently ranks highest (53/100): Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a net.

← Back to latest CVEs