What is the CVSS score of CVE-2026-57108?

CVE-2026-57108 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

How to fix or mitigate CVE-2026-57108?

Within 24 hours: Identify and inventory all systems running .NET 8.0, 9.0, or 10.0, and classify them by criticality to business operations. Within 7 days: Apply the vendor patch released via Microsoft Security Response Center (MSRC) to non-critical systems and establish a staged deployment schedule for production applications. Within 30 days: Complete patch deployment across all .NET 8.0, 9.0, and 10.0 environments.

.NET CVE-2026-57108

Q: Which versions of .NET are affected by CVE-2026-57108?

Microsoft .NET versions 8.0, 9.0, and 10.0 are vulnerable to a remote denial-of-service attack that requires no authentication, allowing attackers to crash or hang affected applications over the…. A patch is available.

EUVD-2026-44278 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-07-14 microsoft

GHSA-rp2p-6cmp-jxj9

Authentication Bypass Memory Corruption Microsoft Net 10 0 Net 8 0 Net 9 0

7.5

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-exposed .NET service
Delivery

Send crafted malformed input
Exploit

Trigger type confusion in runtime
Execution

Unhandled exception crashes worker process
Impact

Repeat to sustain denial of service

Vulnerability Assessment

Weakness	CWE CWE-843 ASVS 5.0 V15 - Secure Coding and Architecture Type safety enforcement MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network reachability to a .NET application that processes attacker-supplied input through the vulnerable type-handling path - no authentication, no privileges, and no user interaction. The concrete prerequisite is that a service built on .NET 8.0, 9.0, or 10.0 exposes a network-accessible input surface that reaches the affected runtime code. Limiting factors: impact is confined to availability (crash/hang), so there is no path to code execution or data theft from this flaw alone; exploitation depends on the target actually being reachable and on the specific input reaching the vulnerable parsing/type path, and applications behind strict input validation or not exposing the affected functionality are correspondingly harder to hit.
Impact	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields 7.5 (High) driven entirely by availability impact - no confidentiality or integrity loss. Attack conditions are favorable to an attacker (network vector, low complexity, no privileges, no user interaction), so weaponization for a crash is plausible, but the ceiling is denial of service only. No EPSS score, KEV listing, or POC was supplied, so this is not confirmed as actively exploited and should be treated as a patch-in-normal-cycle DoS rather than an emergency RCE. Note a data conflict: the input tags include 'Memory Corruption' and 'Authentication Bypass,' but the authoritative CVSS vector shows C:N/I:N/A:H and the description says only 'deny service' - the tags appear auto-generated/inaccurate and should not be used to escalate priority. Real priority is moderate: patch promptly on internet-facing .NET services, but there is no evidence of imminent widespread exploitation.
Exploit ScenarioDerived	An attacker sends a specially crafted request to a network-exposed .NET service (for example an ASP.NET Core API endpoint) whose processing path triggers the type-confusion condition, causing the worker process to throw an unhandled exception and terminate. Because the vector is AV:N/AC:L/PR:N/UI:N, this can be done remotely, without authentication or user interaction, and repeated to sustain an outage. No public exploit is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 1.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or hang affected applications by triggering a type-confusion condition (CWE-843) over the network. The flaw was reported by Microsoft and a vendor patch is available via MSRC; there is no public exploit identified at time of analysis. The CVSS vector limits impact strictly to availability (A:H, C:N/I:N), meaning it is a service-disruption bug rather than a code-execution or data-exposure issue despite tag noise suggesting otherwise.

RemediationAI

Patch available per vendor advisory: apply the Microsoft .NET servicing update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57108 for your installed line (8.0, 9.0, or 10.0), updating both the runtime and, where applicable, the SDK; exact fixed build numbers should be taken from that MSRC page as they are not provided in this dataset. Redeploy or restart affected services after updating so the patched runtime is loaded. Where immediate patching is not possible, reduce exposure by restricting network reachability of affected .NET services to trusted clients (firewall/allowlist), placing a reverse proxy or WAF in front of internet-facing endpoints to reject malformed input, and enabling automatic process restart/health-check recycling so a triggered crash self-heals - with the trade-off that request filtering may not catch the specific malformed payload and auto-restart only limits downtime rather than preventing the DoS.

Affected VersionsENISA

.NET 9.0 9.0.0 <9.0.18

.NET 8.0 8.0.0 <8.0.29

.NET 10.0 10.0.0 <5104034

.NET 10.0 10.0.0 <10.0.6

Affected Packages

nuget microsoft.netcore.app.runtime.linux-arm fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-musl-arm fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-musl-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-musl-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.osx-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.osx-x64 fix: 8.0.29, 9.0.18, 10.0.10

euvd net_10_0 fix: 10.0.6, 5104034

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 11 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

.NET is Microsoft's cross-platform managed runtime and framework used to build and host web services, APIs, and applications. The root cause is CWE-843, 'Access of Resource Using Incompatible Type' (type confusion), in which the runtime treats a region of memory or an object as a type different from its actual type. In a memory-managed runtime this typically surfaces during deserialization, parsing, or reflection paths where attacker-influenced input causes the runtime to misinterpret object layout, leading to an unhandled exception or abort rather than a controlled outcome. The affected CPEs are cpe:2.3:a:microsoft:.net_10.0, cpe:2.3:a:microsoft:.net_9.0, and cpe:2.3:a:microsoft:.net_8.0, indicating all three currently supported .NET lines are impacted.

Know when Net 10 0 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD HIGH

vuln.today AI 7.5 HIGH

Remote, unauthenticated, low-complexity input triggers a crash with no user interaction; impact is availability-only, so C:N/I:N/A:H and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

Microsoft .NET versions 8.0, 9.0, and 10.0 are vulnerable to a remote denial-of-service attack that requires no authentication, allowing attackers to crash or hang affected applications over the network. Organizations running these .NET versions face potential service disruptions affecting customer-facing and internal applications.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

1.1%

Top 38% exploitable

Prevalence

High

widely deployed enterprise runtime across web services and cloud apps

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 1.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.