What is the CVSS score of CVE-2026-21218?

CVE-2026-21218 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of .NET are affected by CVE-2026-21218?

CVE-2026-21218 is a HIGH severity vulnerability affecting .NET applications that could allow attackers to spoof identities and bypass authentication controls over network communications.. A patch is available.

How to fix or mitigate CVE-2026-21218?

Within 24 hours: Identify and inventory all .NET applications and services in production; assess which systems process authentication or handle sensitive transactions. Within 7 days: Implement network segmentation to isolate critical .NET systems; enable enhanced logging for authentication events; brief incident response team on escalation procedures. Within 30 days: Establish daily monitoring for vendor patch release announcements; prepare deployment procedures for rapid patching; conduct security testing of affected applications with compensating controls in place.

.NET CVE-2026-21218

HIGH

Improper Handling of Missing Special Element (CWE-166)

2026-02-10 secure@microsoft.com

GHSA-qvhc-9v3j-5rfw

.NET .Net

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

.NET applications are vulnerable to spoofing attacks due to improper validation of a required security element, allowing unauthenticated remote attackers to forge or manipulate application data over the network. This vulnerability affects multiple .NET versions and currently has no available patch, exposing organizations to authentication bypass and data integrity risks. The attack requires no user interaction and can be exploited directly from the network.

Technical ContextAI

Affects .Net. Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in .NET

View all

CVE-2023-7334 CRITICAL Act Now POC

9.8 Jan 15

Changjetong T+ (through 16.x) has .NET deserialization RCE in an AjaxPro endpoint. Attacker-controlled JSON triggers des

CVE-2019-25359 HIGH This Week POC

8.2 Feb 18

SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL st

CVE-2026-25925 HIGH This Week POC

7.8 Feb 09

PowerDocu versions prior to 2.4.0 allow arbitrary .NET object instantiation and code execution through unsafe deserializ

CVE-2025-24070 HIGH This Week POC

7.0 Mar 11

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a net

CVE-2026-26282 MEDIUM This Month POC

6.6 Feb 19

NanaZip versions 5.0.1252.0 through 6.0.1629.0 contain an out-of-bounds heap read in the .NET Single File bundle parser

CVE-2026-27709 MEDIUM This Month POC

6.6 Feb 26

Out-of-bounds memory read in NanaZip versions 5.0.1252.0 through 6.0.1637.x allows local authenticated attackers to disc

CVE-2020-37103 MEDIUM This Month POC

6.4 Feb 03

DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML

CVE-2026-3263 MEDIUM This Month POC

6.3 Feb 26

Asp.Net-Core-Inventory-Order-Management-System versions up to 9.20250118. contains a security vulnerability (CVSS 6.3).

CVE-2026-26222 CRITICAL Act Now

9.8 Feb 24

Insecure .NET Remoting deserialization in Altec DocLink (Beyond Limits) 4.0.336.0. Exposed TCP endpoints allow unauthent

CVE-2026-25592 CRITICAL Act Now POC

9.9 Feb 06

Microsoft Semantic Kernel SDK has a CVSS 9.9 path traversal vulnerability enabling AI agents to access arbitrary files o

CVE-2026-26333 CRITICAL Act Now

9.8 Feb 13

Unauthenticated .NET Remoting endpoint in Calero VeraSMART before 2022 R1. TCP port 8001 exposes default Object URIs ena

CVE-2026-26335 CRITICAL Act Now POC

9.8 Feb 13

Static ASP.NET machineKey in Calero VeraSMART before 2022 R1. Hardcoded key enables ViewState deserialization attacks an

Same weakness CWE-166 – Improper Handling of Missing Special Element

View all

CVE-2024-38091 HIGH

7.5

CVE-2026-21218 vulnerability details – vuln.today

Back

.NET CVE-2026-21218

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in .NET

Same weakness CWE-166 – Improper Handling of Missing Special Element

Share

External POC / Exploit Code