Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploits this vulnerability could bypass Windows Defender Application Control (WDAC) enforcement. This could lead to the ability to run unauthorized applications on target systems.
How could an attacker exploit this vulnerability?
An authenticated attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process. Successful exploitation could bypass Windows Defender Application Control restrictions and allow the attacker to execute code within the protected process. User interaction is not required.
Security updates
2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 — https://support.microsoft.com/help/5126868
2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 — https://support.microsoft.com/help/5127666
2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 — https://support.microsoft.com/help/5127685
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 — https://support.microsoft.com/help/5127683
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 — https://support.microsoft.com/help/5127687
4.7.4150.0 — https://support.microsoft.com/help/5127667
4.7.4150.0 — https://support.microsoft.com/help/5127668
4.8.4811.0 — https://support.microsoft.com/help/5127684
4.8.4811.0 — https://support.microsoft.com/help/5127686
4.8.4811.0 — https://support.microsoft.com/help/5127688
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 — https://support.microsoft.com/help/5127689
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 — https://support.microsoft.com/help/5127690
4.8.9363.0 — https://support.microsoft.com/help/5127691
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 — https://support.microsoft.com/help/5127692
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 — https://support.microsoft.com/help/5127693
2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0 — https://support.microsoft.com/help/5127694
Vulnerabilities 1
-
High 8.8
.NET Framework Security Feature Bypass Vulnerability
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Revision history
-
#1
Information published.
References
-
CVE-2026-108398 .NET Framework Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss