CVE-2026-23666 - Vulnerability Details

- .NET Framework Denial of Service Vulnerability

Description

Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.

Published: 2026-04-14

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Improper input validation in the .NET Framework enables an unauthorized attacker to trigger a denial of service over a network. This flaw can cause application processes to terminate or become unresponsive, resulting in loss of availability and potential interruption to user tasks. The issue is mapped to CWE-366 (Race Condition) and CWE-755 (Unsafe or Insecure Synchronization Mechanism), reflecting the underlying synchronization weaknesses that surface during input handling.)

Affected Systems

The flaw affects multiple Microsoft .NET Framework releases, including versions 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1. Any system that hosts applications built on these framework versions could be impacted, especially where network exposure is possible.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability. The attack vector is inferred to be network‑based, as the description references denial of service over a network. The vulnerability is not listed in the CISA KEV catalog yet, but the high CVSS and potential for remote exploitation warrant prompt remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft .NET Framework 3.5

affected

Version	Status	Constraints
`3.5.0`	affected	< 2.0.50727.8982 & 3.0.30729.8976

Microsoft

Microsoft .NET Framework 3.5 AND 4.7.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 2.0.50727.9068 & 3.0.30729.9065 & 4.7.4141.0

Microsoft

Microsoft .NET Framework 3.5 AND 4.8

affected

Version	Status	Constraints
`4.8.0`	affected	< 2.0.50727.9068 & 3.0.30729.9065 & 4.8.4801.0

Microsoft

Microsoft .NET Framework 3.5 AND 4.8.1

affected

Version	Status	Constraints
`4.8.1`	affected	< 2.0.50727.9181 & 3.0.30729.9165 & 4.8.9332.0

Microsoft

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

affected

Version	Status	Constraints
`4.7.0`	affected	< 4.8.4801.0

Microsoft

Microsoft .NET Framework 4.8

affected

Version	Status	Constraints
`4.8.0`	affected	< 4.8.4801.0

Configuration 1 [-]

AND

cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

Configuration 2 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:-::::::
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_10_1809:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x86:

Configuration 3 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:-::::::
	cpe:2.3:a:microsoft:.net_framework:4.8:::::::*

OR	cpe:2.3:o:microsoft:windows_10_1809:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1809:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*

Configuration 4 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:3.5:-::::::
	cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::*

OR	cpe:2.3:o:microsoft:windows_10_21h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_21h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_22h2:-::::::x86:
	cpe:2.3:o:microsoft:windows_11_22h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_22h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_23h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_23h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_24h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_24h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_25h2:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_25h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_11_26h1:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11_26h1:-::::::x64:
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2022_23h2:-::::::x64:
	cpe:2.3:o:microsoft:windows_server_2025:-::::::x64:

Configuration 5 [-]

AND

OR	cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::*
	cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::*

OR	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

Configuration 6 [-]

AND

cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*

OR	cpe:2.3:o:microsoft:windows_10_1607:-::::::x64:
	cpe:2.3:o:microsoft:windows_10_1607:-::::::x86:
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*

No data.

Vendor Product Confidence Versions

Microsoft

.net

95%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Microsoft

.net Framework

100%

Version	Status	Scheme	Platform
`[3.5.0,2.0.50727.8982)`	affected	generic	['windows_server_2012', 'windows_server_2012_(server_core_installation)', 'windows_server_2012_r2', 'windows_server_2012_r2_(server_core_installation)']

Microsoft

.net Framework

100%

Version	Status	Scheme	Platform
`[4.7.0,2.0.50727.9068)`	affected	generic	['windows_10_version_1809_for_32-bit_systems', 'windows_10_version_1809_for_arm64-based_systems', 'windows_10_version_1809_for_x64-based_systems']

Microsoft

.net Framework

100%

Version	Status	Scheme	Platform
`[4.8.0,2.0.50727.9068)`	affected	generic	['windows_10_version_1809_for_32-bit_systems', 'windows_10_version_1809_for_arm64-based_systems', 'windows_10_version_1809_for_x64-based_systems', 'windows_10_version_21h2_for_32-bit_systems', 'windows_10_version_21h2_for_arm64-based_systems', 'windows_10_version_21h2_for_x64-based_systems', 'windows_10_version_22h2_for_32-bit_systems', 'windows_10_version_22h2_for_arm64-based_systems', 'windows_10_version_22h2_for_x64-based_systems', 'windows_server_2022', 'windows_server_2022_(server_core_installation)']

Microsoft

.net Framework

100%

Version	Status	Scheme	Platform
`[4.8.1,2.0.50727.9181)`	affected	generic	['windows_10_version_21h2_for_32-bit_systems', 'windows_10_version_21h2_for_arm64-based_systems', 'windows_10_version_21h2_for_x64-based_systems', 'windows_10_version_22h2_for_32-bit_systems', 'windows_10_version_22h2_for_arm64-based_systems', 'windows_10_version_22h2_for_x64-based_systems', 'windows_11_version_22h2_for_arm64-based_systems', 'windows_11_version_22h2_for_x64-based_systems', 'windows_11_version_23h2_for_arm64-based_systems', 'windows_11_version_23h2_for_x64-based_systems', 'windows_11_version_24h2_for_arm64-based_systems', 'windows_11_version_24h2_for_x64-based_systems', 'windows_11_version_25h2_for_arm_systems', 'windows_11_version_25h2_for_x64-based_systems', 'windows_11_version_26h1_for_arm64-based_systems', 'windows_11_version_26h1_for_x64-based_systems', 'windows_server_2022', 'windows_server_2022_(server_core_installation)', 'windows_server_2022,_23h2_edition_(server_core_installation)', 'windows_server_2025', 'windows_server_2025_(server_core_installation)']

Microsoft

.net Framework

100%

Version	Status	Scheme	Platform
`[4.7.0,4.8.4801.0)`	affected	generic	['windows_server_2012', 'windows_server_2012_(server_core_installation)', 'windows_server_2012_r2', 'windows_server_2012_r2_(server_core_installation)']

Microsoft

.net Framework

100%

Version	Status	Scheme	Platform
`[4.8.0,4.8.4801.0)`	affected	generic	['windows_10_version_1607_for_32-bit_systems', 'windows_10_version_1607_for_x64-based_systems', 'windows_server_2012', 'windows_server_2012_(server_core_installation)', 'windows_server_2012_r2', 'windows_server_2012_r2_(server_core_installation)']

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest security update for the .NET Framework from Microsoft’s update guide
If the patch cannot be applied immediately, restrict network access to the vulnerable components to prevent exploitation until the update is installed
Monitor system logs and application performance for signs of service hangs or high CPU usage that could indicate exploitation attempts

Generated by OpenCVE AI on April 16, 2026 at 02:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00106.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666
https://nvd.nist.gov/vuln/detail/CVE-2026-23666
https://www.cve.org/CVERecord?id=CVE-2026-23666

History

Thu, 07 May 2026 20:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2012 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2 Microsoft windows Server 2025
CPEs		cpe:2.3:a:microsoft:.net_framework:3.5:-:::::: cpe:2.3:a:microsoft:.net_framework:4.6.2:::::::* cpe:2.3:a:microsoft:.net_framework:4.7.1:::::::* cpe:2.3:a:microsoft:.net_framework:4.7.2:::::::* cpe:2.3:a:microsoft:.net_framework:4.7:::::::* cpe:2.3:a:microsoft:.net_framework:4.8.1:::::::* cpe:2.3:a:microsoft:.net_framework:4.8:::::::* cpe:2.3:o:microsoft:windows_10_1607:-::::::x64: cpe:2.3:o:microsoft:windows_10_1607:-::::::x86: cpe:2.3:o:microsoft:windows_10_1809:-::::::arm64: cpe:2.3:o:microsoft:windows_10_1809:-::::::x64: cpe:2.3:o:microsoft:windows_10_1809:-::::::x86: cpe:2.3:o:microsoft:windows_10_21h2:-::::::arm64: cpe:2.3:o:microsoft:windows_10_21h2:-::::::x64: cpe:2.3:o:microsoft:windows_10_21h2:-::::::x86: cpe:2.3:o:microsoft:windows_10_22h2:-::::::arm64: cpe:2.3:o:microsoft:windows_10_22h2:-::::::x64: cpe:2.3:o:microsoft:windows_10_22h2:-::::::x86: cpe:2.3:o:microsoft:windows_11_22h2:-::::::arm64: cpe:2.3:o:microsoft:windows_11_22h2:-::::::x64: cpe:2.3:o:microsoft:windows_11_23h2:-::::::arm64: cpe:2.3:o:microsoft:windows_11_23h2:-::::::x64: cpe:2.3:o:microsoft:windows_11_24h2:-::::::arm64: cpe:2.3:o:microsoft:windows_11_24h2:-::::::x64: cpe:2.3:o:microsoft:windows_11_25h2:-::::::arm64: cpe:2.3:o:microsoft:windows_11_25h2:-::::::x64: cpe:2.3:o:microsoft:windows_11_26h1:-::::::arm64: cpe:2.3:o:microsoft:windows_11_26h1:-::::::x64: cpe:2.3:o:microsoft:windows_server_2012:-:::::::* cpe:2.3:o:microsoft:windows_server_2012:r2:::::::* cpe:2.3:o:microsoft:windows_server_2022:-:::::::* cpe:2.3:o:microsoft:windows_server_2022_23h2:-::::::x64: cpe:2.3:o:microsoft:windows_server_2025:-::::::x64:
Vendors & Products		Microsoft windows 10 1607 Microsoft windows 10 1809 Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 11 22h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft windows 11 25h2 Microsoft windows 11 26h1 Microsoft windows Server 2012 Microsoft windows Server 2022 Microsoft windows Server 2022 23h2 Microsoft windows Server 2025

Wed, 15 Apr 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description	Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.	Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.

Wed, 15 Apr 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft .net Framework
Vendors & Products		Microsoft .net Framework

Wed, 15 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 15 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-366
References		https://nvd.nist.gov/vuln/detail/CVE-2026-23666 https://www.cve.org/CVERecord?id=CVE-2026-23666
Metrics	threat_severity `None`	threat_severity `Important`

Tue, 14 Apr 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.
Title		.NET Framework Denial of Service Vulnerability
First Time appeared		Microsoft Microsoft .net
Weaknesses		CWE-755
CPEs		cpe:2.3:a:microsoft:.net::::::::
Vendors & Products		Microsoft Microsoft .net
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C'}`

Subscriptions

Microsoft .net .net Framework Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-04-14T16:57:53.069Z

Updated: 2026-04-30T14:41:48.509Z

Reserved: 2026-01-14T16:59:33.464Z

Link: CVE-2026-23666

Vulnrichment

Updated: 2026-04-15T13:41:03.726Z

NVD

Status : Analyzed

Published: 2026-04-14T18:16:44.507

Modified: 2026-05-07T19:46:16.750

Link: CVE-2026-23666

Redhat

Severity : Important

Publid Date: 2026-04-14T16:57:53Z

Links: CVE-2026-23666 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-16T02:45:06Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object