What is the CVSS score of CVE-2026-32226?

CVE-2026-32226 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-32226?

Yes, a patch is available for CVE-2026-32226. Update the affected software to the latest version immediately.

Microsoft Net Framework 3 5 And 4 7 2 CVE-2026-32226

EUVD-2026-22614 MEDIUM

Race Condition (CWE-362)

2026-04-14 microsoft

GHSA-fpfg-hmcm-qvcj

Authentication Bypass Race Condition Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 8

5.9

CVSS 3.1 · Vendor: microsoft

Temporal: 5.2

Severity by source

Vendor (microsoft) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

5.2 MEDIUM

cvss

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 19:41 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22614

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

MEDIUM 5.9

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in .NET Framework allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft .NET Framework 3.5 and 4.7.2-4.8.1 via race condition in shared resource synchronization allows unauthenticated remote attackers to crash affected applications with high complexity attack requirements. Microsoft has released patches addressing improper concurrent access handling across multiple .NET Framework versions.

Technical ContextAI

The vulnerability stems from CWE-362 (concurrent execution using shared resource with improper synchronization), a classic race condition flaw in multi-threaded code. .NET Framework's runtime manages shared resources across application domains and CLR threads; when multiple threads access the same resource without adequate locking or synchronization primitives, timing-dependent races can occur. The affected versions span .NET Framework 3.5 (CLR 2.0/3.0) through 4.8.1, indicating the flaw exists in fundamental framework resource-handling logic that persists across major version lines. The high attack complexity (AC:H) suggests the race condition requires precise timing or specific environmental conditions to reliably trigger, rather than a simple one-shot exploit. No integrity or confidentiality impact is possible; only availability is compromised, consistent with denial-of-service outcomes from resource exhaustion or process termination.

RemediationAI

Apply vendor-released patch from Microsoft Security Response Center immediately. For .NET Framework 3.5 and 4.7.2, update to at least 2.0.50727.9068 and 4.7.4141.0; for 3.5 and 4.8, update to 2.0.50727.9068 and 4.8.4801.0; for 3.5 and 4.8.1, update to 2.0.50727.9181 and 4.8.9332.0. Patches are distributed via Windows Update and WSUS for supported Windows editions. Organizations unable to patch immediately should restrict network access to .NET Framework applications using firewall rules or load balancers, isolate legacy .NET Framework 3.5 deployments to internal networks only, and monitor for unusual process crashes or DoS patterns in application logs. Consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32226 for platform-specific patching procedures and https://nvd.nist.gov/vuln/detail/CVE-2026-32226 for additional advisory context.