Microsoft Vulnerabilities and Affected Products
Vulnerabilities associated with Microsoft .NET Framework 3.5.
Products
Clear product- Windows Server 20194,131 vulnerabilities
- Windows Server 2019 (Server Core installation)4,034 vulnerabilities
- Windows 10 Version 18093,762 vulnerabilities
- Windows Server 20163,677 vulnerabilities
- Windows Server 20223,485 vulnerabilities
- Windows Server 2016 (Server Core installation)3,473 vulnerabilities
- Windows 10 Version 16073,184 vulnerabilities
- Windows 10 Version 21H23,063 vulnerabilities
- Windows Server 2012 R22,998 vulnerabilities
- Windows Server 2012 R2 (Server Core installation)2,853 vulnerabilities
- Windows Server 20122,824 vulnerabilities
- Windows Server 2012 (Server Core installation)2,691 vulnerabilities
- Windows 10 Version 22H22,565 vulnerabilities
- Windows 10 Version 15072,277 vulnerabilities
- Windows 11 Version 24H21,924 vulnerabilities
- Windows Server 20251,917 vulnerabilities
- Windows Server 2025 (Server Core installation)1,917 vulnerabilities
- Windows Server 2008 R2 Service Pack 11,874 vulnerabilities
- Windows Server 2008 R2 Service Pack 1 (Server Core installation)1,860 vulnerabilities
- Windows 11 Version 23H21,845 vulnerabilities
- Windows 11 version 22H21,776 vulnerabilities
- Windows Server 2022, 23H2 Edition (Server Core installation)1,725 vulnerabilities
- Windows Server 2008 Service Pack 2 (Server Core installation)1,667 vulnerabilities
- Windows Server 2008 Service Pack 21,664 vulnerabilities
- Windows 11 version 21H21,560 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-70354HIGH | .NET Core Remote Code Execution Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/432 ## CVSS Details - **Versi… CWE-787Aug 11, 2026 | CVSS7.8v3.1 | EPSS0.387% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-65810HIGH | .NET Framework Elevation of Privilege VulnerabilityRelative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally. CWE-23Aug 11, 2026 | CVSS7.8v3.1 | EPSS0.351% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62872HIGH | .NET Framework Elevation of Privilege VulnerabilityIncorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network. CWE-863Aug 11, 2026 | CVSS8.8v3.1 | EPSS0.538% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-62897HIGH | .NET Framework Remote Code Execution Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An integer overflow or wraparound in .NET allows an unauthorized attacker to execute code locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/434 ## CVSS Details… CWE-190Aug 11, 2026 | CVSS7.0v3.1 | EPSS0.336% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50659MEDIUM | Generated title:.NET SMTP Client Spoofing Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET SMTP client (System.Net.Mail). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A spoofing vulnerability exists in the SMTP client implementation (System.Net.Mail) in .NET 8, .NET 9, and .NET 10, where an attacker can spoof messages during message routing. ## Announcement Announcement for this issue ca… CWE-116Jul 14, 2026 | CVSS6.5v3.1 | EPSS0.55% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50650HIGH | .NET Framework Elevation of Privilege Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in Windows Presentation Foundation (WPF). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. An elevation of privilege vulnerability exists in Windows Presentation Foundation (WPF) in .NET 8, .NET 9, and .NET 10 when parsing specially crafted XAML input. An attacker who successfully exploits this vulnerability cou… CWE-94Jul 14, 2026 | CVSS7.8v3.1 | EPSS0.29% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50649HIGH | .NET Remote Code Execution VulnerabilityDeserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. CWE-502Jul 14, 2026 | CVSS7.8v3.1 | EPSS0.918% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50648HIGH | .NET Framework Denial of Service Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML … CWE-770Jul 14, 2026 | CVSS7.5v3.1 | EPSS0.84% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50646HIGH | .NET Framework Remote Code Execution VulnerabilityProtection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. | CVSS7.8v3.1 | EPSS0.949% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50527HIGH | .NET Framework Denial of Service Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML … CWE-121Jul 14, 2026 | CVSS7.5v3.1 | EPSS0.84% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50525HIGH | .NET Denial of Service Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability by supplying crafted encrypted XML … CWE-770Jul 14, 2026 | CVSS7.5v3.1 | EPSS0.604% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47304HIGH | .NET Security Feature Bypass Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption (System.Security.Cryptography.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A security feature bypass vulnerability exists in the XML encryption implementation (EncryptedXml) in .NET 8, .NET 9, and .NET 10. An attacker could exploit this vulnerability to bypass encryption protecti… | CVSS8.1v3.1 | EPSS0.216% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-47302HIGH | .NET Denial of Service Vulnerability## Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML processing (System.Security.Cryptography.Xml, System.Xml). This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service vulnerability exists in .NET 8, .NET 9, and .NET 10 related to XML processing. An attacker can exploit XML encryption handling in XML parsing to cause excessive resource con… CWE-770Jul 14, 2026 | CVSS7.5v3.1 | EPSS1.03% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50653HIGH | Azure Active Directory Denial of Service VulnerabilityLoop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network. | CVSS7.5v3.1 | EPSS0.78% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-50652HIGH | Azure Active Directory Denial of Service VulnerabilityDeserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network. CWE-502Jul 14, 2026 | CVSS7.5v3.1 | EPSS1.15% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-35433HIGH | .NET Elevation of Privilege Vulnerability## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0, .NET 9.0, and .NET 10.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/398 ## CVSS Deta… | CVSS7.3v3.1 | EPSS0.662% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-32177HIGH | .NET Elevation of Privilege VulnerabilityHeap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. | CVSS7.3v3.1 | EPSS0.551% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-23666HIGH | .NET Framework Denial of Service VulnerabilityConcurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network. | CVSS7.5v3.1 | EPSS1.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-33116HIGH | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability## Executive Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where an attacker can cause an infinite loop and perform a Denial of Service attack. ## Announcement Announcement for this issue can be found at https://github.com/dotnet/announc… | CVSS7.5v3.1 | EPSS2.14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-32226MEDIUM | .NET Framework Denial of Service VulnerabilityConcurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network. CWE-362Apr 14, 2026 | CVSS5.9v3.1 | EPSS0.542% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-55248MEDIUM | .NET, .NET Framework, and Visual Studio Information Disclosure Vulnerability# Microsoft Security Advisory CVE-2025-55248 | .NET Information Disclosure Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0 and .NET 9.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A MITM (man in the middle) attacker may prevent use of TLS between client and SMTP server, forcing client to send da… CWE-326Oct 14, 2025 | CVSS4.8v3.1 | EPSS0.671% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability# Microsoft Security Advisory CVE-2024-43484 | .NET Denial of Service Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.IO.Packaging. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. The System.IO.Packaging library may allow untrusted inputs to influence algorithmically complex operations, leading to deni… | CVSS-v4.0 | EPSS2.94% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability# Microsoft Security Advisory CVE-2024-43483 | .NET Denial of Service Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Cose, System.IO.Packaging, Microsoft.Extensions.Caching.Memory. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. System.Security.Cryptography.Cose, System.IO.Packa… CWE-407Oct 8, 2024 | CVSS-v4.0 | EPSS2.87% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability# Microsoft Security Advisory CVE-2024-38081 | .NET Elevation of Privilege Vulnerability ## <a name="executive-summary"></a>Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 . This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A Vulnerability exist in Visual Studio installer on Windows OS where an unprivileged user is allowed to manipulate the Visual St… CWE-59Jul 9, 2024 | CVSS-v4.0 | EPSS1.29% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-29059HIGH | .NET Framework Information Disclosure Vulnerability.NET Framework Information Disclosure Vulnerability | CVSS7.5v3.1 | EPSS98.6% | PoCs1 | SignalsListed in CISA KEVNo known ransomware use1 Nuclei template | STIX |