Microsoft Net Framework 3 5 CVE-2026-23666

No special conditions — remote unauthenticated exploitation against default .NET Framework installations accepting concurrent network connections without authentication required.

Real-world risk is MODERATE despite the 7.5 CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote unauthenticated exploitation with low complexity, which appears severe. However, the impact is limited to availability (A:H) with no confidentiality or integrity compromise. EPSS data not provided, but network-accessible denial-of-service vulnerabilities in widely-deployed frameworks typically see moderate exploitation probability. The absence from CISA KEV and lack of public exploit code reduces immediate urgency. The SSVC decision framework suggests DEFER priority: while technically exploitable remotely without authentication, DoS-only impact against a patchable framework with no confirmed active exploitation ranks below RCE or data exposure risks. Organizations should prioritize patching internet-facing .NET applications and high-availability services, but this does not require emergency response unless applications are known targets for DoS campaigns. The race condition nature may require specific timing conditions that reduce reliability in real-world exploitation compared to simpler DoS vectors.

An unauthenticated remote attacker identifies an internet-facing web application or service built on vulnerable .NET Framework versions. The attacker crafts a series of concurrent HTTP requests designed to trigger simultaneous access to shared framework resources, exploiting the race condition in thread synchronization. By repeatedly sending these parallel requests with precise timing, the attacker causes the .NET runtime to enter an inconsistent state, resulting in application crashes or service unavailability. No specialized exploit tools are required given the low attack complexity, though reliable exploitation may require experimentation to identify optimal request patterns and timing.