Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker could provide a specially crafted application that references an unsigned NuGet package. If a user restores or runs the application on an affected Linux system, signature verification might not be enforced, allowing untrusted package content to be installed or executed.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass required NuGet package signature verification on affected Linux systems. This could allow an unsigned package to be accepted when signature validation is required by policy.
Security updates
10.0.402 — https://support.microsoft.com/help/5130036
11.0.100-rc.2 — https://github.com/dotnet/announcements/issues/487
18.10.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
17.14.42 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
Vulnerabilities 1
-
High 8.8
.NET Security Feature Bypass Vulnerability
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
Revision history
-
#2
Updated the Security Updates table to add KB article links for .NET 11.0 and download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.
-
#1
Information published.
References
-
CVE-2026-96957 .NET Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96957
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss