CVE-2018-0786: microsoft corporation .net framework, .net core, and powershell core Improper Certificate Validation
Vulnerability summary
CVE-2018-0786 is a high (CVSS 7.5) Improper Certificate Validation vulnerability in microsoft corporation .net framework, .net core, and powershell core. EPSS estimates a 3.69% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.
Timeline
- 10-01-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · NugetEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.69%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
0.00 pp
From 3.69% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
NuGet7 products
- Microsoft.NETCore.UniversalWindowsPlatform≥ 5.2.0, < 5.2.4 | ≥ 5.3.0, < 5.3.5 | ≥ 5.4.0, < 5.4.2 | ≥ 6.0.0, < 6.0.6
- System.Private.ServiceModel≥ 4.4.0, < 4.4.1 | ≥ 4.3.0, < 4.3.1 | ≥ 4.1.0, < 4.1.1
- System.ServiceModel.Duplex≥ 4.4.0, < 4.4.1 | ≥ 4.3.0, < 4.3.1 | ≥ 4.0.1, < 4.0.2
- System.ServiceModel.Http≥ 4.4.0, < 4.4.1 | ≥ 4.3.0, < 4.3.1 | ≥ 4.1.0, < 4.1.1
- System.ServiceModel.NetTcp≥ 4.4.0, < 4.4.1 | ≥ 4.3.0, < 4.3.1 | ≥ 4.1.0, < 4.1.1
Microsoft3 products
- .net_core1.0 | 2.0
- .net_framework2.0:sp2 | 3.0:sp2 | 3.5 | 3.5.1 | 4.5.2 | 4.6 | 4.6.1 | 4.6.2 | 4.7 | 4.7.1
- powershell_core6.0
Microsoft corporation1 product
- .net framework, .net core, and powershell coreMicrosoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, PowerShell Core 6.0.0
3 vendors · 11 products
References
8 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786X Refsource CONFIRMPatchVendor AdvisoryWEB