CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

CVE-2026-96960 · Severity: high · CVSS 7.5 · Published 2026-10-13

A denial of service vulnerability in Microsoft .NET's XML cryptography library allows remote attackers to exhaust system resources through specially crafted signed XML requests, causing applications to become unresponsive. The flaw affects all supported platforms and could impact any application processing untrusted XML signatures, leading to service outages.

Technologies: Apple macOS, Linux Kernel, Microsoft .Net, Microsoft .NET Framework, Microsoft System.Security.Cryptography.Xml, Microsoft Windows, Microsoft Windows 10 1607, Microsoft Windows 10 1809, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2, Microsoft Windows 11 23h2, Microsoft Windows 11 24h2, Microsoft Windows 11 25h2, Microsoft Windows 11 26h1, Microsoft Windows 11 26h2, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows Server 2025, System.Security.Cryptography.Xml (NuGet). Vendors: Apple, Linux, Microsoft, NuGet.

Quick answers

Is CVE-2026-96960 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96960 being exploited in the wild.
How severe is CVE-2026-96960?
High severity, with a CVSS score of 7.5, published 13 October 2026.
Which products and versions are affected?
Microsoft System.Security.Cryptography.Xml 8.0.0 through 8.0.4, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1; System.Security.Cryptography.Xml (NuGet) >= 10.0.0, <= 10.0.12, ECOSYSTEM:introduced=10.0.0,fixed=10.0.13.
Is there a fix for CVE-2026-96960?
Yes. System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96960 attacked?
It is attacked over the network.
Am I affected by CVE-2026-96960?
Check whether you run Apple macOS, Linux Kernel, Microsoft .Net or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • System.Security.Cryptography.Xml (NuGet): upgrade to 10.0.13 or later
    dotnet add package System.Security.Cryptography.Xml --version 10.0.13

Technical details

The vulnerability in System.Security.Cryptography.Xml is an asymmetric resource consumption flaw (CWE-405) in signed XML processing that lacks proper input-depth and operation-count limits, allowing attackers to craft malicious XML signatures that consume excessive computational resources. The attack requires network connectivity and no authentication or user interaction. The fix adds depth/operation limits, disables DTD processing by default, and validates entity references.

Affected products

  • Microsoft System.Security.Cryptography.Xml 8.0.0 through 8.0.4, 9.0.0 through 9.0.20, 10.0.0 through 10.0.12, 11.0.0-preview.1 through 11.0.0-rc.1

Identifiers

  • CVE-2026-96960
  • GHSA-7hqp-7c5m-4vq6

Timeline

  • 2026-10-13: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.