MSRC-CVE-2026-96238 — .NET Security Feature Bypass Vulnerability

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass NuGet Package Source Mapping, a security feature that restricts packages to approved sources. This could cause content from an unauthorized package source to be selected and installed.

Security updates
9.0.122 — https://support.microsoft.com/help/5130035
11.0.100-rc.2 — https://github.com/dotnet/announcements/issues/486
8.0.426 — https://support.microsoft.com/help/5130034
10.0.113 — https://support.microsoft.com/help/5130036
18.10.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
17.14.42 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes

Vulnerabilities 1

Medium 6.5

CVE-2026-96238

.NET Security Feature Bypass Vulnerability

Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine

Oct 13, 2026

Revision history

2026-10-15 #2
Updated the Security Updates table to add KB article links for .NET 11.0 and download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.
2026-10-13 #1
Information published.

References

CVE-2026-96238 .NET Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96238
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss