Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
According to the CVSS metric, the privileges required is none (PR:N). What does that mean for this vulnerability?
The score is based on no user account is needed to perform the attack.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N) and availability (A:L), but could lead to major loss of integrity (I:H). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could bypass critical-header validation and the service may accept a message it should reject.
Security updates
10.0.3 — https://support.microsoft.com/help/5077862
8.0.24 — https://support.microsoft.com/help/5077863
9.0.13 — https://support.microsoft.com/help/5077864
Vulnerabilities 1
-
High 7.5
.NET Spoofing Vulnerability
Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-21218 .NET Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21218
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss