Microsoft .NET Framework CVE-2026-96959

The target must be a network-reachable service or application built on an affected version of Microsoft .NET Framework (3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8, 4.8.1) or the System.Security.Cryptography.Xml package (<10.0.13) that processes attacker-supplied input through the vulnerable resource-allocation path. Per CVSS PR:N/UI:N/AC:L, no authentication, no user interaction, and no special configuration are required against affected default installations - exploitation succeeds remotely over the network. The practical limiting factors are: the vulnerable .NET service must be exposed to the attacker's network path, and the input must reach the component that performs the uncontrolled allocation (the description does not name the specific feature/protocol, so the exact triggering surface should be verified against the MSRC advisory). Impact is limited to availability only (A:H, C:N, I:N) - no code execution or data exposure.

This is a network-exploitable, unauthenticated denial-of-service vulnerability (CVE-2026-96959, CWE-770, uncontrolled resource allocation) in Microsoft .NET Framework and the System.Security.Cryptography.Xml package. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description - remote, low-complexity, no privileges, no user interaction, with impact confined to availability (C:N/I:N) and no scope change. The 7.5 HIGH score is driven entirely by availability loss; there is no confidentiality or integrity exposure, so this is a service-disruption issue, not an RCE or data-breach risk. CISA's SSVC framework rates Exploitation as 'none' (no observed or public exploitation) but Automatable as 'yes' with 'partial' Technical Impact, meaning an attacker could reliably script the resource-exhaustion trigger at scale even though no exploitation has been seen. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. No POC was referenced. Net assessment: a credible, easily-automatable DoS against a ubiquitous platform that warrants prompt patching, but its priority is tempered by the absence of exploitation signals and the availability-only impact - it is not a confidentiality/integrity emergency. SSVC 'Automatable: yes' is the strongest risk signal here and argues against deferring the patch despite 'Exploitation: none'.

A remote, unauthenticated attacker sends specially crafted input over the network to a service built on the affected .NET Framework or System.Security.Cryptography.Xml component, causing it to allocate resources (memory/CPU) without limit. Repeated or amplified requests exhaust server resources and crash or hang the application, denying service to legitimate users. No public exploit code was identified at time of analysis, but SSVC marks the attack as automatable, so weaponization would be straightforward.