CVE-2026-70194
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
Risk Assessment
Bypassing certificate validation may enable man-in-the-middle attacks, compromising communication integrity and confidentiality.
Recommendation
Update .NET Framework to a version with certificate validation fixes.
Other vulnerabilities in .NET Framework
See all- CVE-2017-8585High
Microsoft .NET Framework versions 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service.
- CVE-2017-0160High
Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7 allows an attacker with access to the local system to execute malicious code, known as '.NET Remote Code Execution Vulnerability.'
- CVE-2016-7270High
The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, allowing remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information.
- CVE-2016-0033High
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, and 4.6.1 does not prevent recursive compilation of XSLT transforms, allowing remote attackers to cause a denial of service via crafted XSLT data.
- CVE-2014-4121High
Microsoft .NET Framework versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 improperly parse internationalized resource identifiers, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application.
- CVE-2014-4073High
A vulnerability in Microsoft .NET Framework allows remote attackers to gain privileges through unverified data during interaction with the ClickOnce installer. It affects versions 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2.
- CVE-2014-1806High
The .NET Remoting implementation in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly restrict memory access, allowing remote attackers to execute arbitrary code via malformed objects.
- CVE-2024-29059HighActively exploited
.NET Framework Information Disclosure Vulnerability. Technical details are not provided in the description.
- CVE-2020-1147HighActively exploited
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
- CVE-2020-0646CriticalActively exploited
A remote code execution vulnerability exists in Microsoft .NET Framework due to improper input validation, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Original NVD description (English source)
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS