Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The authentication feature could be bypassed as this vulnerability allows impersonation.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications. This is called a machine-in-the-middle (MITM) attack.
Security updates
11.0.0 — https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md
Vulnerabilities 1
-
Medium 6.8
.NET Security Feature Bypass Vulnerability
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
Revision history
-
#2
Changes made to the security updates links and information. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-118746 .NET Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118746
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss