.NET CVE-2026-96237

Exploitation requires the victim to process attacker-supplied content within .NET or Visual Studio - consistent with CWE-829, this means functionality is pulled in from an untrusted control sphere (e.g., a crafted project, build input, or dependency) and executed. Two factors LIMIT realistic exploitation: UI:R means a developer/user must actively open, build, or restore the malicious artifact (no silent remote trigger), and AC:H means additional non-trivial conditions must be met for reliable exploitation. Affected and fixed builds are specific: .NET 8.0 (<8.0.132), 9.0 (<9.0.319), 10.0 (<10.0.113), Visual Studio 2022 17.14 (<17.14.42), and Visual Studio 2026 18.10 (<18.10.4); environments on patched builds are not exploitable.

This is a moderate-priority issue rather than a drop-everything emergency, despite the 7.5 (High) CVSS score. The CVSS vector (AV:N/AC:H/PR:N/UI:R) describes a network-reachable, unauthenticated flaw with total CIA impact (C:H/I:H/A:H), but two metrics meaningfully depress real-world exploitability: AC:H (high attack complexity) and UI:R (required user interaction). CISA's SSVC framework reinforces this - Exploitation is rated 'none' and Automatable is 'no', while Technical Impact is 'total', meaning the damage potential is severe but opportunistic mass exploitation is unlikely. No EPSS score, KEV listing, or POC was provided, so there is no signal of active or imminent exploitation. The signals are therefore internally consistent (high impact, low ease of exploitation) rather than conflicting. One notable metadata conflict: the input Tag labels this 'Authentication Bypass', but the description (code execution), CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), and impact metrics all point to remote code execution via untrusted functionality - not an auth-bypass class, so the tag appears mislabeled and should not drive prioritization.

An attacker crafts a malicious artifact (e.g., a project, dependency, or package) that causes .NET or Visual Studio to include and execute functionality from an attacker-controlled source. A developer or user must be lured into opening, building, or restoring the crafted content (UI:R), and successful exploitation also depends on specific preconditions aligning (AC:H), after which arbitrary code runs with the victim's privileges. No public exploit identified at time of analysis.