Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Fixed packages 13

Vulnerabilities 19

• High 8.8
  CVE-2026-70007

  .NET Framework Remote Code Execution Vulnerability

  Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet
  Oct 13, 2026
• High 8.8
  CVE-2026-70035

  .NET Framework Remote Code Execution Vulnerability

  Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet
  Oct 13, 2026
• High 8.8
  CVE-2026-83520

  .NET Remote Code Execution Vulnerability

  Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine NuGet
  Oct 13, 2026
• High 8.8
  CVE-2026-85363

  .NET Framework Elevation of Privilege Vulnerability

  Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Ubuntu Alpine NuGet
  Oct 13, 2026
• High 8.8
  CVE-2026-87697

  .NET Remote Code Execution Vulnerability

  Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine NuGet
  Oct 13, 2026
• High 8.1
  CVE-2026-70197

  .NET and Visual Studio Remote Code Execution Vulnerability

  Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Linux Windows macOS Ubuntu Alpine NuGet
  Oct 13, 2026
• High 7.8
  CVE-2026-96225

  .NET Elevation of Privilege Vulnerability

  Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.8
  CVE-2026-96231

  .NET Elevation of Privilege Vulnerability

  Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-58280

  .NET Denial of Service Vulnerability

  Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-69651

  .NET Denial of Service Vulnerability

  Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-70159

  ASP.NET Core Denial of Service Vulnerability

  Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 Microsoft.AspNetCore.SignalR.Core Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-84008

  .NET Denial of Service Vulnerability

  Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-96233

  ASP.NET Core Denial of Service Vulnerability

  Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 AND 4.7.2 Microsoft .NET Framework 3.5 AND 4.8 Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• High 7.5
  CVE-2026-96237

  .NET Remote Code Execution Vulnerability

  Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine
  Oct 13, 2026
• High 7.4
  CVE-2026-96222

  Active Directory Federation Services (AD FS) Spoofing Vulnerability

  Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• Medium 6.5
  CVE-2026-96238

  .NET Security Feature Bypass Vulnerability

  Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine
  Oct 13, 2026
• Medium 5.9
  CVE-2026-66822

  .NET Information Disclosure Vulnerability

  Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• Medium 5.9
  CVE-2026-70162

  .NET Denial of Service Vulnerability

  A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthent…

  Microsoft Microsoft Visual Studio 2022 version 17.14 Microsoft Visual Studio 2026 version 18.10 System.Security.Cryptography.Pkcs Ubuntu Alpine Wolfi NuGet
  Oct 13, 2026
• Medium 5.3
  CVE-2026-96234

  .NET Information Disclosure Vulnerability

  Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

  Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 8.0 runtime Ubuntu Alpine NuGet
  Oct 13, 2026

References

• report
  https://access.redhat.com/security/cve/CVE-2026-70159
• report
  https://access.redhat.com/security/cve/CVE-2026-70162
• article
  https://access.redhat.com/security/updates/classification/
• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-70007
• report
  https://access.redhat.com/security/cve/CVE-2026-87697
• report
  https://access.redhat.com/security/cve/CVE-2026-70035
• report
  https://access.redhat.com/security/cve/CVE-2026-70197
• report
  https://access.redhat.com/security/cve/CVE-2026-85363
• report
  https://access.redhat.com/security/cve/CVE-2026-96234
• report
  https://access.redhat.com/security/cve/CVE-2026-83520
• report
  https://access.redhat.com/security/cve/CVE-2026-58280
• report
  https://access.redhat.com/security/cve/CVE-2026-69651
• report
  https://access.redhat.com/security/cve/CVE-2026-66822
• report
  https://access.redhat.com/security/cve/CVE-2026-96222
• report
  https://access.redhat.com/security/cve/CVE-2026-96237
• report
  https://access.redhat.com/security/cve/CVE-2026-96238
• report
  https://access.redhat.com/security/cve/CVE-2026-96233
• report
  https://access.redhat.com/security/cve/CVE-2026-96231
• report
  https://access.redhat.com/security/cve/CVE-2026-96225
• report
  https://access.redhat.com/security/cve/CVE-2026-84008
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84693.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548778
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-58280
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-58280
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548781
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-66822
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-66822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2548784
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-69651
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-69651
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2551740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-70007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-70007
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70007
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2551409
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-70035
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-70035
• article
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70035