« Volver al listado

CVE-2026-108398

Estado: Pendiente de análisisAlta (8.8)—

Ruta de búsqueda no confiable en .NET Framework permite a un atacante autorizado eludir una característica de seguridad de forma local.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

El vector AV:L/PR:L/UI:N indica explotación local con privilegios bajos; CWE-426 (ruta de búsqueda no confiable) sugiere secuestro de ruta, aunque no se nombra el mecanismo concreto.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionUpdate SoftwareApplication Developer GuidanceUser Account ManagementThreat Intelligence ProgramRestrict File and Directory Permissions

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Microsoft — NET FrameworkAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-108398",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-108398",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-13T22:17:39.221098Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0.0",
              "lessThan": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows 10 version 1607",
            "Windows Server 2016",
            "Windows Server 2019"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
          "versions": [
            {
              "status": "affected",
              "version": "4.7.0",
              "lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows 10 version 1809"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 3.5 AND 4.8",
          "versions": [
            {
              "status": "affected",
              "version": "4.8.0",
              "lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows 10 version 1809",
            "Windows 10 version 21H2",
            "Windows 10 version 22H2",
            "Windows Server 2019",
            "Windows Server 2022"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 3.5 AND 4.8.1",
          "versions": [
            {
              "status": "affected",
              "version": "4.8.1",
              "lessThan": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows 10 version 21H2",
            "Windows 10 version 22H2",
            "Windows 11 version 23H2",
            "Windows 11 version 24H2",
            "Windows 11 version 25H2",
            "Windows 11 version 26H2",
            "Windows Server 2022",
            "Windows Server 2025"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
          "versions": [
            {
              "status": "affected",
              "version": "4.7.0",
              "lessThan": "4.7.4150.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows Server 2012",
            "Windows Server 2012 R2"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 4.8",
          "versions": [
            {
              "status": "affected",
              "version": "4.8.0",
              "lessThan": "4.8.4811.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows 10 version 1607",
            "Windows Server 2012",
            "Windows Server 2012 R2",
            "Windows Server 2016"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft .NET Framework 4.8.1",
          "versions": [
            {
              "status": "affected",
              "version": "4.8.0.0",
              "lessThan": "4.8.9363.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows 11 version 26H1"
          ]
        }
      ]
    }
  ],
  "published": "2026-10-13T19:18:04.963",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398",
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally."
    }
  ],
  "lastModified": "2026-10-13T23:17:30.117",
  "sourceIdentifier": "secure@microsoft.com"
}