Microsoft .NET: Denial of service through inefficient algorithm in XML Encryption

Summary

Microsoft .NET runtimes, .NET Framework and Visual Studio contain an inefficient algorithm in the XML Encryption component (System.Security.Cryptography.Xml and System.Private.Xml). An unauthenticated attacker on the network can send crafted XML to a service that decrypts XML or verifies signed XML, which can make the service unavailable. The risk exists only where an application processes untrusted XML through this code path. Microsoft published fixes on 13 October 2026.

Affected

• .NET 8.0.0 before 8.0.32
• .NET 9.0.0 before 9.0.21
• .NET 10.0.0 before 10.0.13
• .NET 11.0.0-preview.1 before 11.0.0-rc.2
• .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 and 4.8.1 on affected Windows builds (see MSRC page for the per-version list)
• Visual Studio 2022 version 17.14 before 17.14.42
• Visual Studio 2026 version 18.10 before 18.10.4
• Unverified: .NET 6 (listed by HeroDevs only, not by Microsoft)

Fixed in

• .NET 8.0.32
• .NET 9.0.21
• .NET 10.0.13
• .NET 11.0.0-rc.2 or later
• .NET Framework: cumulative Windows updates of 13 October 2026 (see MSRC page for builds)
• Visual Studio 2022 17.14.42
• Visual Studio 2026 18.10.4
• Linux distributions: fixed packages per Red Hat and Ubuntu (USN-8942-1)

Workaround

Unknown.

• No official workaround beyond patching was found in the Microsoft advisory.
• Practical measure: identify applications that process untrusted XML through EncryptedXml or verify signatures with the XML decryption transform.

Exploitation

• No known exploitation in the wild in the sources checked.
• No public proof of concept found. Microsoft credits four external reporters.
• CISA SSVC in the CVE record: exploitation none, automatable yes, technical impact partial.
• EPSS 0.01103 at the time of the snippet.

Our recommendation

• Inventory .NET runtimes, ASP.NET Core applications, NuGet references and Windows .NET Framework builds.
• Install the fixed versions: .NET 8.0.32, 9.0.21, 10.0.13 or 11.0.0-rc.2, and the Windows updates of 13 October 2026. Rebuild and redeploy self-built applications.
• Prioritise internet-facing applications that process XML through EncryptedXml or signed-XML verification, such as SSO/SAML or B2B XML interfaces.
• Check whether any .NET 6 systems exist and clarify support status, because Microsoft has not confirmed this version as affected.
• Patch internal systems too, because the impact is loss of availability.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-69651 msrc.microsoft.com
• GitLab Advisory: Microsoft.NETCore.App.Runtime (NuGet) advisories.gitlab.com
• dotnet/runtime issue 135698 github.com
• Red Hat Bugzilla 2548784 bugzilla.redhat.com
• OSV: UBUNTU-CVE-2026-69651 osv.dev
• Microsoft Support: .NET Framework update 13 October 2026 (KB5127696) support.microsoft.com
• Visual Studio 2026 release notes learn.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:27.