[ CVE-2026-96222 · Published 13 Oct 2026 ]
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
[ Description ]Official description
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
[ Fixes ]Fixes and patches
- System.Security.Cryptography.Xml 8.0.5Fixed version · GitHub Advisories · nuget package System.Security.Cryptography.Xml: upgrade to 8.0.5 or later (affected >= 8.0.0, <= 8.0.4)
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1313
Multiple vulnerabilities in Microsoft .Net Translated from French
Multiple vulnerabilities have been discovered in Microsoft .Net. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
CERT-FRCERTFR-2026-AVI-1316
Multiple vulnerabilities in Microsoft products Translated from French
Multiple vulnerabilities have been discovered in Microsoft products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
-
CERT-FRCERTFR-2026-AVI-1314
Multiple vulnerabilities in Microsoft Windows Translated from French
Multiple vulnerabilities have been discovered in Microsoft Windows. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service. Microsoft reports that…
-
BSI CERT-BundWID-SEC-2026-3893
Microsoft Entwicklerwerkzeuge: Multiple vulnerabilities Translated from German
-
BSI CERT-BundWID-SEC-2026-3892
Microsoft Windows and Windows Server: Multiple vulnerabilities Translated from German
[ Packages ]Affected open-source packages
- System.Security.Cryptography.Xml nugetAffected >= 8.0.0, <= 8.0.4 · fixed in 8.0.5 · GHSA-vrv5-2jg9-4mmr
[ References ]References
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96222Vendor Advisory