Microsoft .NET: Security feature bypass due to improper signature verification

Summary

Improper verification of cryptographic signatures in Microsoft .NET allows an attacker to bypass a security feature over a network. According to Microsoft, on affected Linux systems signature verification might not be enforced, so untrusted package content could be installed or executed, and NuGet package signature checks could be bypassed. Exploitation requires that a user restores or runs untrusted content, and no privileges are needed. Microsoft rates the issue Important (CVSS 8.8).

Affected

• Microsoft .NET 10.0 runtime: 10.0.0 to below 10.0.402 (CNA record)
• Microsoft .NET 11.0 runtime: 11.0.0 to below 11.0.100-rc.2 (CNA record)
• Microsoft Visual Studio 2022 version 17.14: 17.14.0 to below 17.14.42 (CNA record)
• Microsoft Visual Studio 2026 version 18.10: 18.10.0 to below 18.10.4 (CNA record)
• Conflicting data: Bitnami lists .NET 10.0.0 up to 10.0.13; a third-party tracker lists the .NET SDK below 10.0.13. Verification against the MSRC advisory is pending.

Fixed in

• Fixed in .NET 10.0 from 10.0.402 according to the CNA record; the Bitnami record and a third-party tracker give 10.0.13. Verify the exact build on the MSRC advisory.
• Fixed in .NET 11.0 from 11.0.100-rc.2 according to the CNA record.
• Fixed in Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4 according to the CNA record.
• Ubuntu-packaged .NET: unverified.

Workaround

• No vendor workaround known.
• Do not restore or run .NET projects or file-based apps from untrusted sources.
• Use only trusted NuGet feeds.
• Limit who can build on shared machines until patched.

Exploitation

• Not publicly disclosed and not known to be exploited (Microsoft, exploit maturity "Unproven").
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS score about 0.0046 (low predicted likelihood).
• No public proof of concept found.
• CISA KEV status: verify on CISA's site.

Our recommendation

• Install the latest Microsoft updates for .NET 10.0, .NET 11.0, Visual Studio 2022 17.14 and Visual Studio 2026 18.10 on developer workstations, build servers and Linux hosts.
• Confirm the fixed build numbers in the MSRC advisory before approving a specific version.
• Check Linux systems with the .NET runtime and track Ubuntu and other distribution packages separately.
• Apply the interim measures above until patched.
• Priority: high for organisations that build or deploy .NET software or rely on NuGet signature checks; medium for ordinary desktop users without .NET development tools.
• Monitor vendor advisories for updates.

(Note: the fixed versions and KEV status are not yet verified.)

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96957 msrc.microsoft.com
• Red Hat CVE page: CVE-2026-96957 access.redhat.com
• CVE list record (Vulners): CVE-2026-96957 vulners.com
• Ubuntu CVE page: CVE-2026-96957 ubuntu.com
• OSV Bitnami record: BIT-dotnet-2026-96957 osv.dev
• OpenCVE: CVE-2026-96957 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:51.