[ CVE-2026-70194 · Published 13 Oct 2026 ]
Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability
CVSS 6.5
EPSS <1%4 agency advisoriesFix available
[ Description ]Official description
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
[ Fixes ]Fixes and patches
- Microsoft.NETCore.App.Runtime.linux-arm 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.linux-arm: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.linux-arm64 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.linux-arm64: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.linux-musl-arm 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.linux-musl-arm: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.linux-musl-arm64 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.linux-musl-arm64: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.linux-musl-x64 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.linux-musl-x64: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.linux-x64 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.linux-x64: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.osx-arm64 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.osx-arm64: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
- Microsoft.NETCore.App.Runtime.osx-x64 11.0.0-rc.2Fixed version · GitHub Advisories · nuget package Microsoft.NETCore.App.Runtime.osx-x64: upgrade to 11.0.0-rc.2 or later (affected >= 11.0.0-preview.1, <= 11.0.0-rc.1)
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1313
Multiple vulnerabilities in Microsoft .Net Translated from French
Multiple vulnerabilities have been discovered in Microsoft .Net. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
CERT-FRCERTFR-2026-AVI-1316
Multiple vulnerabilities in Microsoft products Translated from French
Multiple vulnerabilities have been discovered in Microsoft products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
BSI CERT-BundWID-SEC-2026-3893
Microsoft Entwicklerwerkzeuge: Multiple vulnerabilities Translated from German
-
NCSC-NLNCSC-2026-0426
Vulnerabilities fixed in Microsoft Developer Tools Translated from Dutch
[ Packages ]Affected open-source packages
- Microsoft.NETCore.App.Runtime.linux-arm nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.linux-arm64 nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.linux-musl-arm nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.linux-musl-arm64 nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.linux-musl-x64 nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.linux-x64 nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.osx-arm64 nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm
- Microsoft.NETCore.App.Runtime.osx-x64 nugetAffected >= 11.0.0-preview.1, <= 11.0.0-rc.1 · fixed in 11.0.0-rc.2 · GHSA-fqpq-cx42-9jmm