CVE-2026-47304: .NET Security Feature Bypass Vulnerability
Analyzed
AliasesUBUNTU-CVE-2026-47304CGA-27vq-22rh-w5m2CGA-2h67-5p83-cq3qCGA-2j22-7q9g-7fwrCGA-2mqw-8mcm-xxrxCGA-323r-6848-vrq3CGA-386j-3xrw-mqp2CGA-387r-w46j-248rCGA-38h7-hm7h-r4jfCGA-3fqj-9vjh-pmwpCGA-3hf4-8fw6-p7ghCGA-3v4x-9wxx-j3gjCGA-3wvq-j4f8-v64gCGA-5559-39qh-mwcvCGA-55gv-c528-37mfCGA-5gpm-5vr8-8735CGA-5j9x-6r6f-mv9fCGA-5pr7-7cg2-q5q3CGA-6hhv-rp3m-322gCGA-6m53-94hx-cc9wCGA-6wfm-mww9-pfr2CGA-6x5w-mc48-2p53CGA-6x8f-9m4c-vcrmCGA-83m2-7g5m-mfjqCGA-8689-6668-f24rCGA-8pvp-c443-29vcCGA-8vpv-ccmg-r27vCGA-8wf3-7pjp-r38gCGA-93gf-4vwq-h277CGA-93vr-q76c-r93gCGA-94v3-79r7-2982CGA-987h-hgcx-2pg5CGA-9q8c-8gpx-9w2pCGA-9wg5-9gv5-p93fCGA-c5jj-9mh9-38p3CGA-chgp-ppm2-29cjCGA-cjfc-qqpm-vpp5CGA-cmcx-52hw-74mhCGA-cqfc-7x9h-3x93CGA-cw7h-9938-84qvCGA-f8x2-227r-5xc2CGA-ghp6-7fq5-vm77CGA-gmvr-fvx8-mq83CGA-h3fg-4pg6-r72wCGA-h3gq-pq34-f8q9CGA-h3jf-mhgw-7p5hCGA-hh3w-p72g-jfmgCGA-hxqr-vmqc-344jCGA-j7rr-pmpr-2cgwCGA-j98x-vhpq-2g44CGA-jpqq-6947-pxqrCGA-jqv5-2hhx-8379CGA-jxjc-4r72-qw8vCGA-mj9r-qq3g-r5xrCGA-p4c8-r775-ccvmCGA-p76m-xh55-7fj5CGA-pm63-m4w7-4gmvCGA-q7pw-vvr9-9vjjCGA-qgx2-hwc2-c739CGA-rj9h-gp8j-9prrCGA-rmx2-fxv6-94f4CGA-rrwq-8pgx-gc7jCGA-rvrg-xj53-pcg3CGA-v2x2-592x-4p69CGA-vhxv-m9pm-x8prCGA-vjx7-39qg-gpgqCGA-vr92-hh6v-gj8wCGA-w3mc-gpwx-ffpcCGA-w7vm-f5x4-686hCGA-wf59-grjh-r5hmCGA-wgc3-wrj4-3fc2CGA-wj47-rrpc-55vwCGA-x62q-vpph-g4q9CGA-xm54-mmpf-wpg3CGA-xr8j-fpr4-fcq2CGA-xx62-pfc7-v4wpGHSA-g8r8-53c2-pm3fBIT-dotnet-2026-47304BIT-dotnet-sdk-2026-47304ALPINE-CVE-2026-47304
Published 14-07-2026Last modified 01-11-2026
Vulnerability summary
CVE-2026-47304 is a critical (CVSS 9.8) vulnerability in microsoft microsoft .net framework 3.5. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.1% of scored vulnerabilities.
Priority
Prioritisesevere
Severe, CVSS 8.1 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.29%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 16 · Related 2Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 01-11-2026Last modifiedVulnerability information updated.
Description
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources7 sources · 8.1–9.8
- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:CDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · NugetEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.29% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.
- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Microsoft22 products
- microsoft .net framework 3.5≥ 3.5.0, < 2.0.50727.8983 & 3.0.30729.8978
- microsoft .net framework 3.5 and 4.7.2≥ 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
- microsoft .net framework 3.5 and 4.8≥ 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
- microsoft .net framework 3.5 and 4.8.1≥ 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
- microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2≥ 4.7.0, < 4.7.4143.0
Chainguard8 products
- aspnet-8-targeting-pack< 8.0.131-r0
- dotnet-8-sdk< 8.0.129-r1
- dotnet-bootstrap-8< 8.0.129-r0 | < 8.0.130-r0
- dotnet-bootstrap-9< 9.0.120-r0
- dotnet-sdk-10.0.2< 10.0.204-r4
Wolfi8 products
- aspnet-8-targeting-pack< 8.0.131-r0
- dotnet-8-sdk< 8.0.129-r1
- dotnet-bootstrap-8< 8.0.129-r0 | < 8.0.130-r0
- dotnet-bootstrap-9< 9.0.120-r0
- dotnet-sdk-10.0.2< 10.0.204-r4
Ubuntu4 products
- dotnet10< 10.0.110-10.0.10-0ubuntu1~24.04.1 | < 10.0.110-10.0.10-0ubuntu1~26.04.1
- dotnet6All versions (No fix recorded)
- dotnet7All versions (No fix recorded)
- dotnet8< 8.0.129-8.0.29-0ubuntu1~22.04.1 | < 8.0.129-8.0.29-0ubuntu1~24.04.1
Alpine3 products
- dotnet10-runtime< 10.0.10-r0
- dotnet8-runtime< 8.0.29-r0
- dotnet9-runtime< 9.0.18-r0
NuGet1 product
- System.Security.Cryptography.Xml≥ 10.0.0, < 10.0.10 | ≥ 9.0.0, < 9.0.18 | ≥ 8.0.0, < 8.0.4
6 vendors · 46 products
References
11 links
- github.com/dotnet/runtimePACKAGE