Microsoft .NET CVE-2026-96238

Exploitation requires a victim using an affected .NET runtime (8.0 <8.0.426, 9.0 <9.0.122, 10.0 <10.0.113, 11.0 <11.0.100-rc.2) or affected Visual Studio build to perform an interaction (UI:R) - typically visiting or acting on attacker-supplied cross-origin content - which triggers the flawed origin validation. The attacker is unauthenticated (PR:N) and remote (AV:N), but the mandatory user-interaction step is the primary limiting factor, meaning exploitation cannot be fully automated or triggered server-side without a human in the loop. Impact is confined to integrity (I:H; no confidentiality or availability loss), and exploitation depends on the application actually relying on the affected .NET origin-validation security feature.

This is a moderate-severity (CVSS 6.5) origin validation flaw (CWE-346) whose real-world urgency is tempered by several concordant low-risk signals. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated bypass that nonetheless REQUIRES user interaction and affects integrity only (C:N/A:N). CISA's SSVC framework reinforces a non-emergency posture: Exploitation=none, Automatable=no, Technical Impact=partial - i.e. not currently exploited and not mass-exploitable. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation. The signals are internally consistent rather than conflicting: a network-facing but interaction-gated, integrity-only security-feature bypass that is not automatable aligns with a 6.5 rating. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Overall this is a 'patch in normal cycle' issue rather than an emergency, though the ubiquity of the affected .NET runtimes means the aggregate exposure across environments is large and should not be deprioritized indefinitely.

An attacker crafts a malicious web page or cross-origin request and lures an authenticated victim running an affected .NET application to interact with it (the UI:R requirement). Because origin validation is improperly enforced, the attacker's request is accepted as if from a trusted origin, allowing the attacker to bypass the intended security feature and tamper with protected resources (I:H). No public exploit code has been identified at time of analysis.