CVE-2026-96958
Status: Awaiting AnalysisHigh (7.5)—
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Base score: 7.5
Exploitation probability (EPSS)
FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1190Exploit Public-Facing Applicationinitial access90 % - Primary impact
T1499Endpoint Denial of Serviceimpact85 %
El vector CVSS AV:N/PR:N/UI:N permite explotar por red sin credenciales la complejidad algorítmica ineficiente en .NET, con impacto de disponibilidad alto (A:H) y denegación de servicio.
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-407
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-96958",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-96958",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-10-13T19:38:05.330473Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5",
"versions": [
{
"status": "affected",
"version": "3.5.0",
"lessThan": "2.0.50727.9188 AND 3.0.30729.9171",
"versionType": "custom"
}
],
"platforms": [
"Windows 11 version 26H1",
"Windows Server 2012",
"Windows Server 2012 R2"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",
"versions": [
{
"status": "affected",
"version": "3.0.0.0",
"lessThan": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1607",
"Windows Server 2016",
"Windows Server 2019"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.7.2",
"versions": [
{
"status": "affected",
"version": "4.7.0",
"lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1809"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.8",
"versions": [
{
"status": "affected",
"version": "4.8.0",
"lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1809",
"Windows 10 version 21H2",
"Windows 10 version 22H2",
"Windows Server 2019",
"Windows Server 2022"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 3.5 AND 4.8.1",
"versions": [
{
"status": "affected",
"version": "4.8.1",
"lessThan": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 21H2",
"Windows 10 version 22H2",
"Windows 11 version 23H2",
"Windows 11 version 24H2",
"Windows 11 version 25H2",
"Windows 11 version 26H2",
"Windows Server 2022",
"Windows Server 2025"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
"versions": [
{
"status": "affected",
"version": "4.7.0",
"lessThan": "4.7.4150.0",
"versionType": "custom"
}
],
"platforms": [
"Windows Server 2012",
"Windows Server 2012 R2"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 4.8",
"versions": [
{
"status": "affected",
"version": "4.8.0",
"lessThan": "4.8.4811.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 10 version 1607",
"Windows Server 2012",
"Windows Server 2012 R2",
"Windows Server 2016"
]
},
{
"vendor": "Microsoft",
"product": "Microsoft .NET Framework 4.8.1",
"versions": [
{
"status": "affected",
"version": "4.8.0.0",
"lessThan": "4.8.9363.0",
"versionType": "custom"
}
],
"platforms": [
"Windows 11 version 26H1"
]
},
{
"vendor": "Microsoft",
"product": "System.Security.Cryptography.Xml",
"versions": [
{
"status": "affected",
"version": "10.0.0",
"lessThan": "10.0.13",
"versionType": "custom"
}
],
"platforms": [
".NET 10.0 installed on Linux",
".NET 10.0 installed on Mac OS",
".NET 10.0 installed on Windows",
".NET 11.0 installed on Linux",
".NET 11.0 installed on Mac OS",
".NET 11.0 installed on Windows",
".NET 8.0 installed on Linux",
".NET 8.0 installed on Mac OS",
".NET 8.0 installed on Windows",
".NET 9.0 installed on Linux",
".NET 9.0 installed on Mac OS",
".NET 9.0 installed on Windows"
]
}
]
}
],
"published": "2026-10-13T19:22:08.387",
"references": [
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96958",
"source": "secure@microsoft.com"
}
],
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"type": "Secondary",
"source": "secure@microsoft.com",
"description": [
{
"lang": "en",
"value": "CWE-407"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network."
}
],
"lastModified": "2026-10-13T20:19:33.493",
"sourceIdentifier": "secure@microsoft.com"
}