Multiple critical vulnerabilities in Microsoft .Net enable remote code execution, privilege escalation, and DoS
Multiple vulnerabilities have been disclosed in Microsoft .Net affecting versions 8.0, 9.0, 10.0, and 11.0 on Linux, Mac OS, and Windows platforms. These flaws permit attackers to perform remote code execution, privilege escalation, denial of service, and data confidentiality breaches. The vulnerabilities affect all versions prior to specified patched releases (e.g., 10.0.404 for .Net 10.0, 11.0.100 for .Net 11.0), necessitating prompt updating. Microsoft has published detailed security advisories and patches for these issues as of November 10, 2026. Users and administrators are advised to promptly apply these patches in order to mitigate the impact and secure their environments against potential exploitation.
Entenda a falha
A vulnerabilidade
Microsoft published a batch of 22 CVEs for .NET (CVE-2026-105544 through CVE-2026-120796) on November 10, 2026. The articles do not give per-CVE details or severity. Together the flaws allow remote code execution, privilege escalation, denial of service, data confidentiality breaches and security policy bypass. Affected: .NET 8.0 before 8.0.34 (Windows: before 8.0.428), 9.0 before 9.0.23 (Windows: before 9.0.321), 10.0 before 10.0.404 and 11.0 before 11.0.100, on Linux, macOS and Windows. The fixed releases are those version numbers. The articles do not say what an attacker needs in terms of authentication or user interaction.
Como foi descoberta
The articles do not say who found these flaws or how. Microsoft published individual advisories for each CVE on its update guide on November 10, 2026, together with patches. The French CERT-FR then issued a summary advisory on November 12, 2026, pointing readers to the vendor bulletins for the fixes.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:21.
Linha do tempo
-
Multiple critical vulnerabilities in Microsoft .Net enable remote code execution, privilege escalation, and DoS
ler a análise desta fonte ocultar
Multiple vulnerabilities have been disclosed in Microsoft .Net affecting versions 8.0, 9.0, 10.0, and 11.0 on Linux, Mac OS, and Windows platforms. These flaws permit attackers to perform remote code execution, privilege escalation, denial of service, and data confidentiality breaches. The vulnerabilities affect all versions prior to specified patched releases (e.g., 10.0.404 for .Net 10.0, 11.0.100 for .Net 11.0), necessitating prompt updating. Microsoft has published detailed security advisories and patches for these issues as of November 10, 2026. Users and administrators are advised to promptly apply these patches in order to mitigate the impact and secure their environments against potential exploitation.