Microsoft .NET CVE-2026-70194

Requires the target to run a vulnerable .NET 11 runtime (11.0.0-preview.1 through 11.0.0-rc.1) on Linux or macOS AND to use mutual TLS with post-handshake client-certificate authentication in System.Net.Security. The server must be configured to require and enforce client certificates for the bypass to have security value. LIMITING FACTORS: only pre-release (preview/RC) .NET 11 builds are affected - released/LTS runtimes and legacy .NET Framework are not implicated; Windows is not listed among affected platforms (advisory cites Linux/macOS only); and applications that do not use post-handshake mTLS client authentication are not exposed. Remediation is to update to .NET 11.0.0-rc.2, Visual Studio 2026 18.10.4, or 2022 17.14.42.

Moderate, condition-dependent risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5) signals a network-reachable, unauthenticated, low-complexity flaw with no user interaction - which in isolation looks attractive, but the C:L/I:L/A:N impact caps it at a security-feature bypass rather than full compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or probable exploitation; all three exploitation signals are therefore absent rather than conflicting. The practical risk is sharply narrowed by the exploitation precondition from the GHSA advisory: the target application must use .NET 11 mutual-TLS with post-handshake client authentication on Linux or macOS. Note a source discrepancy: the NVD-style description says '.NET Framework,' but every authoritative reference (GHSA-fqpq-cx42-9jmm, dotnet/runtime, affected NuGet runtime packages) identifies modern .NET 11 (System.Net.Security), not the legacy .NET Framework - verify product scope before triaging. Net judgment: a real but niche bypass affecting pre-release builds, not a broad high-urgency priority.

A server application built on a vulnerable .NET 11 preview/RC runtime (Linux/macOS) requires mutual TLS and relies on post-handshake client certificate authentication to gate access. An attacker connects over the network and triggers the post-handshake renegotiation path where the client certificate is not properly verified, so the mutual-authentication requirement is bypassed and the attacker is treated as an authenticated client. No public exploit code was identified at time of analysis.