CVE-2026-96960
Estado: Pendiente de análisisAlta (7.5)—
Consumo asimétrico de recursos (amplificación) en .NET permite a un atacante no autorizado provocar una denegación de servicio a través de una red.
Traducción automática del texto original de NVD (en inglés).
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access85 % - Impacto principal
T1499Endpoint Denial of Serviceimpact70 %
Vector AV:N/PR:N/UI:N (red sin privilegios) da T1190; la descripción indica denegación de servicio por red mediante consumo asimétrico de recursos (CWE-405) en .NET.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-405
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-96960",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-96960",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-13T19:37:53.830470Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5",
"versions": [
{
"status": "affected",
"version": "3.5.0",
"lessThan": "2.0.50727.9188 AND 3.0.30729.9171",
"versionType": "custom"
}
],
"platforms": [
"Windows 11 version 26H1",
"Windows Server 2012",
"Windows Server 2012 R2"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",
"versions": [
{
"status": "affected",
"version": "3.0.0.0",
"lessThan": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1607",
"Windows Server 2016",
"Windows Server 2019"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.7.2",
"versions": [
{
"status": "affected",
"version": "4.7.0",
"lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1809"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.8",
"versions": [
{
"status": "affected",
"version": "4.8.0",
"lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1809",
"Windows 10 version 21H2",
"Windows 10 version 22H2",
"Windows Server 2019",
"Windows Server 2022"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.8.1",
"versions": [
{
"status": "affected",
"version": "4.8.1",
"lessThan": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 21H2",
"Windows 10 version 22H2",
"Windows 11 version 23H2",
"Windows 11 version 24H2",
"Windows 11 version 25H2",
"Windows 11 version 26H2",
"Windows Server 2022",
"Windows Server 2025"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
"versions": [
{
"status": "affected",
"version": "4.7.0",
"lessThan": "4.7.4150.0",
"versionType": "custom"
}
],
"platforms": [
"Windows Server 2012",
"Windows Server 2012 R2"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 4.8",
"versions": [
{
"status": "affected",
"version": "4.8.0",
"lessThan": "4.8.4811.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1607",
"Windows Server 2012",
"Windows Server 2012 R2",
"Windows Server 2016"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 4.8.1",
"versions": [
{
"status": "affected",
"version": "4.8.0.0",
"lessThan": "4.8.9363.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 11 version 26H1"
]
},
{
"vendor": "Microsoft",
"product": "System.Security.Cryptography.Xml",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.13",
"versionType": "custom"
}
],
"platforms": [
".NET 10.0 installed on Linux",
".NET 10.0 installed on Mac OS",
".NET 10.0 installed on Windows",
".NET 11.0 installed on Linux",
".NET 11.0 installed on Mac OS",
".NET 11.0 installed on Windows",
".NET 8.0 installed on Linux",
".NET 8.0 installed on Mac OS",
".NET 8.0 installed on Windows",
".NET 9.0 installed on Linux",
".NET 9.0 installed on Mac OS",
".NET 9.0 installed on Windows"
]
}
]
}
],
"published": "2026-10-13T19:22:08.670",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960",
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-405"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network."
}
],
"lastModified": "2026-10-13T20:19:33.743",
"sourceIdentifier": "secure@microsoft.com"
}