# Microsoft .Net vulnerabilities Source: https://junglewise.ai/threats/technologies/microsoft-net Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 19 October 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/microsoft-net.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 34 vulnerabilities in Microsoft .Net: 17 in the last 7 days and 19 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-70035, was published on 13 October 2026. 17 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. ## Counts - Last 7 days: 17 - Last 30 days: 17 - Last 90 days: 19 - All time: 34 (2 critical, 1 exploited in the wild) ## About Microsoft .Net Microsoft framework for building and running applications on Windows, web, and cloud platforms. ## Latest Microsoft .Net vulnerabilities - [CVE-2026-70035: .NET WindowsDesktop.App.Runtime deserialization remote code execution](https://junglewise.ai/threats/cve-2026-70035-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-70007: Microsoft .NET and Visual Studio WPF heap out-of-bounds write](https://junglewise.ai/threats/cve-2026-70007-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-87697: .NET WPF XPS synthetic hyperlinks remote code execution](https://junglewise.ai/threats/cve-2026-87697-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-96234: Microsoft .NET WPF origin validation error in URI handling](https://junglewise.ai/threats/cve-2026-96234-microsoft-security-advisory-net-and-visual-studio-information) (medium, CVSS 5.3, published 13 Oct 2026) - [CVE-2026-96235: Microsoft .NET WPF heap out-of-bounds access in pixel-shader parsing](https://junglewise.ai/threats/cve-2026-96235-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-70197: .NET System.Net.Sockets out-of-bounds write in IPv4/IPv6 datagram handling](https://junglewise.ai/threats/cve-2026-70197-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-96233: .NET System.Runtime DateTime parsing out-of-bounds read](https://junglewise.ai/threats/cve-2026-96233-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-70194: .NET TLS client certificate verification bypass](https://junglewise.ai/threats/cve-2026-70194-microsoft-security-advisory-net-and-visual-studio-security) (medium, CVSS 6.5, published 13 Oct 2026) - [CVE-2026-96960: Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96960-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-96959: Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-96959-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-96957: .NET cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-96957-improper-verification-of-cryptographic-signature-in-net-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-85790: Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.](https://junglewise.ai/threats/cve-2026-85790-microsoft-security-advisory-net-information-disclosure) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-69651: Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-69651-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-66822: Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a…](https://junglewise.ai/threats/cve-2026-66822-microsoft-security-advisory-net-and-visual-studio-information) (medium, CVSS 5.9, published 13 Oct 2026) - [CVE-2026-58280: Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.](https://junglewise.ai/threats/cve-2026-58280-microsoft-security-advisory-net-and-visual-studio-denial-of) (high, CVSS 7.5, published 13 Oct 2026) - [CVE-2026-105016: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-105016-microsoft-security-advisory-microsoft-quic-remote-code-execution) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-102869: .NET and Visual Studio type confusion privilege elevation](https://junglewise.ai/threats/cve-2026-102869-access-of-resource-using-incompatible-type-type-confusion-in-net) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-62886: Microsoft .NET WPF elevation of privilege via integer overflow](https://junglewise.ai/threats/cve-2026-62886-microsoft-net-wpf-elevation-of-privilege-via-integer-overflow) (high, CVSS 7.8, published 11 Aug 2026) - [CVE-2026-62899: Microsoft .NET security feature bypass in System.Net.HttpListener](https://junglewise.ai/threats/cve-2026-62899-microsoft-net-security-feature-bypass-in-system-net-httplistener) (medium, CVSS 5.9, published 11 Aug 2026) - [CVE-2026-50659: Microsoft .NET and Visual Studio spoofing vulnerability](https://junglewise.ai/threats/cve-2026-50659-microsoft-net-and-visual-studio-spoofing-vulnerability) (medium, CVSS 6.5, published 14 Jul 2026) - [CVE-2026-50650: Microsoft .NET Framework code injection privilege escalation](https://junglewise.ai/threats/cve-2026-50650-microsoft-net-framework-code-injection-privilege-escalation) (high, CVSS 7.8, published 14 Jul 2026) - [CVE-2026-50524: Microsoft .NET Framework denial of service via improper input validation](https://junglewise.ai/threats/cve-2026-50524-microsoft-net-framework-denial-of-service-via-improper-input) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-47302: Microsoft .NET denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-47302-microsoft-net-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 14 Jul 2026) - [CVE-2026-42899: Microsoft ASP.NET Core infinite loop denial of service](https://junglewise.ai/threats/cve-2026-42899-microsoft-asp-net-core-infinite-loop-denial-of-service) (high, CVSS 7.5, published 12 May 2026) - [CVE-2026-35433: Microsoft .NET heap overflow elevation of privilege](https://junglewise.ai/threats/cve-2026-35433-microsoft-net-heap-overflow-elevation-of-privilege) (high, CVSS 7.3, published 12 May 2026) ## Most severe Microsoft .Net vulnerabilities - [CVE-2023-38180: .NET Denial of Service Vulnerability](https://junglewise.ai/threats/cve-2023-38180-microsoft-net-core-and-visual-studio-denial-of-service) (critical, exploited in the wild, CVSS 3.1, published 9 Aug 2023) - [CVE-2026-105016: Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.](https://junglewise.ai/threats/cve-2026-105016-microsoft-security-advisory-microsoft-quic-remote-code-execution) (critical, CVSS 9.8, published 13 Oct 2026) - [CVE-2026-70035: .NET WindowsDesktop.App.Runtime deserialization remote code execution](https://junglewise.ai/threats/cve-2026-70035-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-87697: .NET WPF XPS synthetic hyperlinks remote code execution](https://junglewise.ai/threats/cve-2026-87697-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-96235: Microsoft .NET WPF heap out-of-bounds access in pixel-shader parsing](https://junglewise.ai/threats/cve-2026-96235-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-102869: .NET and Visual Studio type confusion privilege elevation](https://junglewise.ai/threats/cve-2026-102869-access-of-resource-using-incompatible-type-type-confusion-in-net) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-70007: Microsoft .NET and Visual Studio WPF heap out-of-bounds write](https://junglewise.ai/threats/cve-2026-70007-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-96957: .NET cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-96957-improper-verification-of-cryptographic-signature-in-net-allows-an) (high, CVSS 8.8, published 13 Oct 2026) - [CVE-2026-70197: .NET System.Net.Sockets out-of-bounds write in IPv4/IPv6 datagram handling](https://junglewise.ai/threats/cve-2026-70197-microsoft-security-advisory-net-and-visual-studio-remote-code) (high, CVSS 8.1, published 13 Oct 2026) - [CVE-2026-62886: Microsoft .NET WPF elevation of privilege via integer overflow](https://junglewise.ai/threats/cve-2026-62886-microsoft-net-wpf-elevation-of-privilege-via-integer-overflow) (high, CVSS 7.8, published 11 Aug 2026) ## Vulnerabilities per week 17 vulnerabilities in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 27 Jul 2026 | 0 | 0 | 0 | | 3 Aug 2026 | 0 | 0 | 0 | | 10 Aug 2026 | 2 | 0 | 0 | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 17 | 1 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | ## Other Microsoft technologies - [Microsoft Windows](https://junglewise.ai/threats/technologies/windows-): 1,706 vulnerabilities - [Microsoft Windows 10](https://junglewise.ai/threats/technologies/windows-10): 588 vulnerabilities - [Microsoft Windows 11](https://junglewise.ai/threats/technologies/windows-11): 493 vulnerabilities - [Microsoft Windows 11 24h2](https://junglewise.ai/threats/technologies/windows-11-24h2): 486 vulnerabilities - [Microsoft Windows Server 2012](https://junglewise.ai/threats/technologies/windows-server-2012): 473 vulnerabilities - [Microsoft Windows Server 2019](https://junglewise.ai/threats/technologies/windows-server-2019): 469 vulnerabilities - [Microsoft Windows Server 2022](https://junglewise.ai/threats/technologies/windows-server-2022): 461 vulnerabilities - [Microsoft Windows 11 25h2](https://junglewise.ai/threats/technologies/windows-11-25h2): 455 vulnerabilities - [Microsoft Windows Server 2016](https://junglewise.ai/threats/technologies/windows-server-2016): 427 vulnerabilities - [Microsoft Windows Server 2025](https://junglewise.ai/threats/technologies/windows-server-2025): 427 vulnerabilities - [Microsoft Windows 10 21h2](https://junglewise.ai/threats/technologies/windows-10-21h2): 359 vulnerabilities - [Microsoft Windows 10 22h2](https://junglewise.ai/threats/technologies/windows-10-22h2): 358 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Microsoft .Net vulnerabilities", https://junglewise.ai/threats/technologies/microsoft-net, 19 October 2026.