Microsoft .NET CVE-2026-96957

Exploitation requires a .NET application (or Visual Studio tooling build in the affected ranges) that relies on the framework's cryptographic signature verification - consistent with the 'Jwt Attack' tag, most plausibly a JWT or token-signature validation path. The attacker is unauthenticated (PR:N) and remote (AV:N), but the UI:R metric means a user or application must process the attacker-supplied, forged-signature token for the bypass to occur, which is the primary limiting factor; purely passive server endpoints that never consume such input may not be reachable. Only applications running the vulnerable .NET versions (.NET 10.0 <10.0.402, .NET 11.0 <11.0.100-rc.2) or the listed Visual Studio builds are affected. The exact feature/configuration that invokes the flawed verification is not specified in the available data and should be confirmed against the MSRC advisory.

This is a credible priority despite the absence of exploitation signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw with high impact to confidentiality, integrity, and availability (8.8 High), and CWE-347 (improper cryptographic signature verification) combined with the vendor tags 'Authentication Bypass' and 'Jwt Attack' points to a signature/token forgery that defeats a security feature - a class of bug that is reliably weaponizable once details are public. However, several signals are MISSING rather than conflicting: there is no EPSS score, no CISA KEV listing, and no POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' One internal tension to verify: the vector carries UI:R (user interaction required), which is unusual for a server-side signature-verification bypass and may indicate the vulnerable code path is triggered when a client/tool consumes an attacker-supplied token - confirm the exact trigger with Microsoft's MSRC advisory. Net: treat as a high-priority patch given the signature-bypass primitive and broad .NET footprint, but exploitation is currently theoretical/unconfirmed, not active.

An attacker crafts a token or message with a forged or malformed cryptographic signature and delivers it to a .NET application that relies on the framework's signature verification (e.g., a JWT-based auth flow). Because verification is improperly performed, the application accepts the forged signature as valid and the attacker bypasses the authentication/security control. The UI:R metric suggests the target application or tool must process the attacker-supplied token; no public exploit code is identified at time of analysis.