Microsoft .NET Framework 3.5 vulnerabilities
77 vulnerabilities
Known vulnerabilities in Microsoft .NET Framework 3.5, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-97801microsoftmicrosoft .net framework 3.5+7
EPSS score0.61%
Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.CVE-2026-97788microsoftmicrosoft .net framework 3.5+37EPSS score0.68%
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.CVE-2026-96960chainguardaspnet-9-targeting-pack+33EPSS score1.03%
Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96959chainguardaspnet-9-targeting-pack+33EPSS score0.75%
Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96958chainguardaspnet-9-targeting-pack+33EPSS score1.03%
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-96233chainguarddotnet-bootstrap-8+27EPSS score0.77%
Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-96224microsoftmicrosoft .net framework 3.5+16EPSS score0.74%
Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.CVE-2026-96222chainguarddotnet-8-sdk+26EPSS score0.58%
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.CVE-2026-85363microsoftmicrosoft .net framework 3.5+16EPSS score0.74%
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.CVE-2026-84008chainguardactions-runner+35EPSS score0.77%
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-83520microsoftmicrosoft .net framework 3.5+16EPSS score1.27%
Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.CVE-2026-70174microsoftmicrosoft .net framework 3.5+16EPSS score0.80%
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.CVE-2026-70035microsoftmicrosoft .net framework 3.5+16EPSS score1.27%
Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.CVE-2026-70007microsoftmicrosoft .net framework 3.5+16EPSS score0.64%
Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.CVE-2026-69651chainguarddotnet-bootstrap-8+28EPSS score1.10%
Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-58280chainguarddotnet-bootstrap-8+29EPSS score1.10%
Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.CVE-2025-55248chainguarddotnet-bootstrap-8+37EPSS score0.72%
Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network.CVE-2020-16937microsoftmicrosoft .net framework 2.0 service pack 2+12EPSS score3.29%
<p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the vulnerability could disclose contents of an affected system's memory.</p>
<p>To exploit the vulnerability, an authenticated attacker would need to run a specially crafted application.</p>
<p>The update addresses the vulnerability by correcting how the .NET Framework handles objects in memory.</p>CVE-2020-1046microsoftmicrosoft .net framework 2.0 service pack 2+5EPSS score3.76%
A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system.
To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a web application.
The security update addresses the vulnerability by correcting how .NET Framework processes input.CVE-2020-1147microsoftmicrosoft .net framework 2.0+132KEVEPSS score93.97%
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.