Technology · Microsoft
Microsoft .Net vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 34 vulnerabilities in Microsoft .Net: 17 in the last 7 days and 19 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-70035, was published on 13 October 2026. 17 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0.
- Last 7 days
- 17
- Last 90 days
- 19
- Critical, all time
- 2
- Exploited in the wild
- 1
About Microsoft .Net
Microsoft framework for building and running applications on Windows, web, and cloud platforms.
Latest Microsoft .Net vulnerabilities
- CVE-2026-70035: .NET WindowsDesktop.App.Runtime deserialization remote code executionhighCVSS 8.8EPSS 1.3%
- CVE-2026-70007: Microsoft .NET and Visual Studio WPF heap out-of-bounds writehighCVSS 8.8EPSS 0.6%
- CVE-2026-87697: .NET WPF XPS synthetic hyperlinks remote code executionhighCVSS 8.8EPSS 0.8%
- CVE-2026-96234: Microsoft .NET WPF origin validation error in URI handlingmediumCVSS 5.3EPSS 0.3%
- CVE-2026-96235: Microsoft .NET WPF heap out-of-bounds access in pixel-shader parsinghighCVSS 8.8EPSS 0.7%
- CVE-2026-70197: .NET System.Net.Sockets out-of-bounds write in IPv4/IPv6 datagram handlinghighCVSS 8.1EPSS 0.7%
- CVE-2026-96233: .NET System.Runtime DateTime parsing out-of-bounds readhighCVSS 7.5EPSS 0.8%
- CVE-2026-70194: .NET TLS client certificate verification bypassmediumCVSS 6.5EPSS 0.4%
- CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.highCVSS 7.5EPSS 1.1%
- CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.highCVSS 7.5EPSS 0.8%
- CVE-2026-96957: .NET cryptographic signature verification bypasshighCVSS 8.8EPSS 0.5%
- CVE-2026-85790: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.mediumCVSS 5.9EPSS 0.7%
- CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.highCVSS 7.5EPSS 1.1%
- CVE-2026-66822: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a…mediumCVSS 5.9EPSS 0.7%
- CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.highCVSS 7.5EPSS 1.1%
- CVE-2026-105016: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.criticalCVSS 9.8EPSS 1.0%
- CVE-2026-102869: .NET and Visual Studio type confusion privilege elevationhighCVSS 8.8EPSS 0.7%
- CVE-2026-62886: Microsoft .NET WPF elevation of privilege via integer overflowhighCVSS 7.8EPSS 0.5%
- CVE-2026-62899: Microsoft .NET security feature bypass in System.Net.HttpListenermediumCVSS 5.9EPSS 0.8%
- CVE-2026-50659: Microsoft .NET and Visual Studio spoofing vulnerabilitymediumCVSS 6.5EPSS 0.7%
- CVE-2026-50650: Microsoft .NET Framework code injection privilege escalationhighCVSS 7.8EPSS 0.5%
- CVE-2026-50524: Microsoft .NET Framework denial of service via improper input validationhighCVSS 7.5EPSS 1.2%
- CVE-2026-47302: Microsoft .NET denial of service via resource exhaustionhighCVSS 7.5EPSS 1.2%
- CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of servicehighCVSS 7.5EPSS 2.4%
- CVE-2026-35433: Microsoft .NET heap overflow elevation of privilegehighCVSS 7.3EPSS 0.6%
Most severe Microsoft .Net vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2023-38180: .NET Denial of Service Vulnerabilitycriticalexploited in the wildCVSS 3.1EPSS 14.0%
- CVE-2026-105016: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.criticalCVSS 9.8EPSS 1.0%
- CVE-2026-70035: .NET WindowsDesktop.App.Runtime deserialization remote code executionhighCVSS 8.8EPSS 1.3%
- CVE-2026-87697: .NET WPF XPS synthetic hyperlinks remote code executionhighCVSS 8.8EPSS 0.8%
- CVE-2026-96235: Microsoft .NET WPF heap out-of-bounds access in pixel-shader parsinghighCVSS 8.8EPSS 0.7%
- CVE-2026-102869: .NET and Visual Studio type confusion privilege elevationhighCVSS 8.8EPSS 0.7%
- CVE-2026-70007: Microsoft .NET and Visual Studio WPF heap out-of-bounds writehighCVSS 8.8EPSS 0.6%
- CVE-2026-96957: .NET cryptographic signature verification bypasshighCVSS 8.8EPSS 0.5%
- CVE-2026-70197: .NET System.Net.Sockets out-of-bounds write in IPv4/IPv6 datagram handlinghighCVSS 8.1EPSS 0.7%
- CVE-2026-62886: Microsoft .NET WPF elevation of privilege via integer overflowhighCVSS 7.8EPSS 0.5%
Vulnerabilities per week
17 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 27 Jul 2026 | 0 | 0 | |
| 3 Aug 2026 | 0 | 0 | |
| 10 Aug 2026 | 2 | 0 | |
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 17 | 1 | |
| 19 Oct 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Microsoft .Net vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/microsoft-net)<a href="https://junglewise.ai/threats/technologies/microsoft-net"><img src="https://junglewise.ai/threats/technologies/microsoft-net/badge.svg" alt="Microsoft .Net vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/microsoft-net.json, and this page as text at https://junglewise.ai/threats/technologies/microsoft-net.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Microsoft .Net vulnerabilities", https://junglewise.ai/threats/technologies/microsoft-net, 19 October 2026.