Improper certificate validation in the .NET Framework enables an unauthorized attacker to bypass a security feature over a network. The flaw allows acceptance of forged certificates, which can lead to a breach of confidentiality and integrity. Based on the description, it is inferred that the vulnerability might be exploited through man‑in‑the‑middle attacks or other forms of credential compromise. This vulnerability is classified as CWE‑295, indicating a failure to properly validate certificate chains.

Microsoft .NET Framework 11.0, Microsoft Visual Studio 2022 version 17.14, and Microsoft Visual Studio 2026 version 18.10 are affected by this weakness.

The CVSS score of 6.5 indicates a moderate severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based, as the flaw requires the attacker to present a forged certificate to a system using the affected .NET components. Exploitation would require network connectivity to the target application and could be performed without prerequisite access to the victim machine.