Executive brief
A security vulnerability has been identified in the .NET SMTP client, a component used by developers to send emails from applications. An attacker could exploit this flaw to spoof email messages during the routing process, potentially leading to the delivery of fraudulent communications that appear to come from legitimate sources. Organizations using affected versions of .NET should update their runtime and SDKs to prevent unauthorized message manipulation.
Technical details
A spoofing vulnerability exists in the System.Net.Mail SMTP client implementation within .NET 8, 9, and 10. The root cause is improper encoding or escaping of output (CWE-116), which allows an attacker to manipulate message routing. An attacker with network access and low privileges can exploit this to spoof email communications. The vulnerability affects all platforms and architectures where the vulnerable .NET runtimes are deployed. Microsoft has released patches in versions 8.0.29, 9.0.18, and 10.0.10. Developers must update their .NET SDKs/runtimes and redeploy any self-contained applications.
Affected products
- Microsoft .NET 8.0.0 - 8.0.28, 9.0.0 - 9.0.17, 10.0.0 - 10.0.9
Timeline
- 2026-07-14: disclosed: Advisory published by Microsoft.
- 2026-07-20: advisory: GitHub Advisory updated.
References
- https://github.com/dotnet/runtime/security/advisories/GHSA-74jp-vm22-8q8x
- https://github.com/dotnet/announcements/issues/423
- https://github.com/dotnet/runtime/issues/130716
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659
- https://api.github.com/repos/dotnet/runtime/security-advisories/GHSA-74jp-vm22-8q8x