Description
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
Published: 2026-10-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized tampering of .NET Framework components over a network
Action: Apply patch
AI Analysis

Impact

The vulnerability stems from improper validation of a specified type of input in the .NET Framework, enabling an unauthorized attacker to tamper with components over a network. This flaw allows manipulation of application data and configuration without proper checks, potentially compromising the integrity of the affected software and creating avenues for further exploitation.

Affected Systems

Microsoft .NET Framework versions 3.5 and 4.6.2 through 4.8.1 are impacted, including all intermediate releases from 4.7 to 4.8.1.

Risk and Exploitability

The vulnerability is assigned a CVSS score of 7.5, indicating a high severity. EPSS data is not available, so precise exploitation probability remains uncertain. The flaw is not listed in CISA's KEV catalog. The likely attack vector is remote network-based, requiring an attacker to send specially crafted requests to a vulnerable .NET Framework instance, potentially leading to tampering and unauthorized modifications.

Generated by OpenCVE AI on October 14, 2026 at 12:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the latest security update for the affected .NET Framework versions, as provided by Microsoft through the update guide.
  • Until the update can be applied, isolate systems running the vulnerable framework from critical networks using segmentation or firewall rules to limit exposure.
  • Disable or restrict any insecure configuration options within the .NET Framework that could facilitate the tampering, and consider enforcing stricter input validation policies at the application level.

Generated by OpenCVE AI on October 14, 2026 at 12:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
Title .NET Framework Tampering Vulnerability
First Time appeared Microsoft
Microsoft .net
Microsoft .net Framework
Weaknesses CWE-1287
CPEs cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft .net
Microsoft .net Framework
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C'}

Subscriptions

Microsoft .net .net Framework
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:13:31.543Z

Reserved: 2026-09-25T04:41:33.499Z

Link: CVE-2026-97801

cve-icon Vulnrichment

Updated: 2026-10-13T22:18:53.467Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:22:18.023

Modified: 2026-10-13T23:19:33.740

Link: CVE-2026-97801

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T20:23:56Z

Weaknesses
  • CWE-1287

    Improper Validation of Specified Type of Input