CVE-2026-96960

nvd nist

Published: Oct 13, 2026Modified: Oct 22, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: secure@microsoft.com (Secondary)

Description

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Affected (29)

Products: Microsoft: .net, .net Framework

Microsoft

2 products

.net

.net Framework

Configuration A

11 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net	10.0.0 ≤ version < 10.0.13
Microsoft .net	8.0.0 ≤ version < 8.0.5
Microsoft .net	9.0.0 ≤ version < 9.0.21
Microsoft .net	Version 11.0.0 preview1
Microsoft .net	Version 11.0.0 preview2
Microsoft .net	Version 11.0.0 preview3
Microsoft .net	Version 11.0.0 preview4
Microsoft .net	Version 11.0.0 preview5
Microsoft .net	Version 11.0.0 preview6
Microsoft .net	Version 11.0.0 preview7
Microsoft .net	Version 11.0.0 rc1

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.8.1

Running on/with	Platform Versions
Microsoft Windows 11 26h1	All versions

Configuration C

1 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.8

Running on/with	Platform Versions
Microsoft Windows 10 1607	All versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2
Microsoft Windows Server 2016	All versions

Configuration D

4 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 4.6.2
Microsoft .net Framework	Version 4.7.1
Microsoft .net Framework	Version 4.7.2
Microsoft .net Framework	Version 4.7

Running on/with	Platform Versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2

Configuration E

2 vulnerable · 8 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5
Microsoft .net Framework	Version 4.8.1

Running on/with	Platform Versions
Microsoft Windows 10 21h2	All versions
Microsoft Windows 10 22h2	All versions
Microsoft Windows 11 23h2	All versions
Microsoft Windows 11 24h2	All versions
Microsoft Windows 11 25h2	All versions
Microsoft Windows 11 26h2	All versions
Microsoft Windows Server 2022	All versions
Microsoft Windows Server 2025	All versions

Configuration F

2 vulnerable · 5 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5
Microsoft .net Framework	Version 4.8

Running on/with	Platform Versions
Microsoft Windows 10 1809	All versions
Microsoft Windows 10 21h2	All versions
Microsoft Windows 10 22h2	All versions
Microsoft Windows Server 2019	All versions
Microsoft Windows Server 2022	All versions

Configuration G

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5
Microsoft .net Framework	Version 4.7.2

Running on/with	Platform Versions
Microsoft Windows 10 1809	All versions

Configuration H

5 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5
Microsoft .net Framework	Version 4.6.2
Microsoft .net Framework	Version 4.7.1
Microsoft .net Framework	Version 4.7.2
Microsoft .net Framework	Version 4.7

Running on/with	Platform Versions
Microsoft Windows 10 1607	All versions
Microsoft Windows Server 2016	All versions
Microsoft Windows Server 2019	All versions

Configuration I

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft .net Framework	Version 3.5

Running on/with	Platform Versions
Microsoft Windows 11 26h1	All versions
Microsoft Windows Server 2012	All versions
Microsoft Windows Server 2012	Version r2

Related CWEs

CWE-405

Asymmetric Resource Consumption (Amplification)

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

References (1)

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96960

Source: secure@microsoft.com

Vendor Advisory

Timeline

No history available yet.