/
← Voltar ao feed
high

CERT-FR: Multiple Microsoft .NET and ASP.NET Core vulnerabilities, including remote code execution, fixed in October 2026 updates

1 fonte(s) · 1 atualização(ões) · publicado 13/10/2026 21:00 · coletado há 3 dias

CERT-FR advisory CERTFR-2026-AVI-1313 reports multiple vulnerabilities in Microsoft .NET, ASP.NET Core and .NET Framework, covered by Microsoft's October 13, 2026 security bulletins for 43 CVEs. Some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also lists security policy bypass and compromise of data integrity and confidentiality. It does not state that any of the flaws is actively exploited, and it gives no technical details, IOCs or attribution. The affected scope is broad, covering .NET 8.0, 9.0, 10.0 and 11.0 (RC) on Windows, Linux and macOS, plus several .NET Framework branches.

Detalhes técnicos

  • Affected products: .NET 8.0 before 8.0.32 (SDK 8.0.132 / 8.0.426), .NET 9.0 before 9.0.21 (SDK 9.0.122 / 9.0.319), .NET 10.0 before 10.0.13 (SDK 10.0.113 / 10.0.402; 10.0.14 on Windows), .NET 11.0 before 11.0.0-rc.2 (SDK 11.0.100-rc.2), ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2.
  • Microsoft .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8 and 4.8.1 before the fixed builds listed in the advisory (for example 4.8 before 4.8.4811.0 and 4.8.1 before 4.8.9363.0 or 4.8.10008.0).
  • The advisory does not map impacts to individual CVEs.

Remediação

  • Apply the fixes referenced in the Microsoft security bulletins of October 13, 2026 for every affected .NET, ASP.NET Core and .NET Framework version.
  • Update runtimes and SDKs on Windows, Linux and macOS hosts, including build servers and container images.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 13/10/2026 21:00 · coletado 20/10 16:32 primeiro registro

    CERT-FR: Multiple Microsoft .NET and ASP.NET Core vulnerabilities, including remote code execution, fixed in October 2026 updates

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1313 reports multiple vulnerabilities in Microsoft .NET, ASP.NET Core and .NET Framework, covered by Microsoft's October 13, 2026 security bulletins for 43 CVEs. Some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also lists security policy bypass and compromise of data integrity and confidentiality. It does not state that any of the flaws is actively exploited, and it gives no technical details, IOCs or attribution. The affected scope is broad, covering .NET 8.0, 9.0, 10.0 and 11.0 (RC) on Windows, Linux and macOS, plus several .NET Framework branches.

    Technical Details

    • Affected products: .NET 8.0 before 8.0.32 (SDK 8.0.132 / 8.0.426), .NET 9.0 before 9.0.21 (SDK 9.0.122 / 9.0.319), .NET 10.0 before 10.0.13 (SDK 10.0.113 / 10.0.402; 10.0.14 on Windows), .NET 11.0 before 11.0.0-rc.2 (SDK 11.0.100-rc.2), ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13 and 11.0 before 11.0.0-rc.2.
    • Microsoft .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8 and 4.8.1 before the fixed builds listed in the advisory (for example 4.8 before 4.8.4811.0 and 4.8.1 before 4.8.9363.0 or 4.8.10008.0).
    • The advisory does not map impacts to individual CVEs.

    Remediation

    • Apply the fixes referenced in the Microsoft security bulletins of October 13, 2026 for every affected .NET, ASP.NET Core and .NET Framework version.
    • Update runtimes and SDKs on Windows, Linux and macOS hosts, including build servers and container images.