Microsoft .NET Framework CVE-2026-96960

The target application must process untrusted, attacker-supplied XML using the affected .NET cryptography component (System.Security.Cryptography.Xml, e.g. SignedXml / XML signature verification) within an affected build - per EUVD: .NET Framework 3.5, 4.6.2/4.7/4.7.1/4.7.2, 4.8 below 4.8.4811.0, 4.8.1 below 4.8.9363.0, and System.Security.Cryptography.Xml below 10.0.13. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or non-default configuration is required beyond exposing such an endpoint to the network. The practical limiting factor is that the application must actually accept and cryptographically process externally supplied XML, so services that do not expose XML parsing/signature processing to untrusted input are not reachable; impact is confined to availability (service outage), with no path to data disclosure or code execution.

Signals are moderately consistent and point to a genuine but bounded availability risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated denial of service with availability-only impact and no confidentiality or integrity loss, consistent with CWE-405 (Asymmetric Resource Consumption / amplification). CISA SSVC reinforces a non-emergency posture: Exploitation=none (no observed exploitation), Automatable=yes (a DoS request can be scripted and repeated), Technical Impact=partial (service disruption, not full compromise). No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis. Net assessment: this is a patch-on-normal-cycle availability issue rather than an emergency - real because it is network-reachable and automatable against a ubiquitous runtime, but constrained because impact is limited to denial of service with no active exploitation evidenced. One conflict must be flagged explicitly: the input Tag 'Authentication Bypass' contradicts both CWE-405 and the C:N/I:N/A:H impact (pure availability), so that tag appears mislabeled and should not drive triage.

An attacker identifies a network-exposed .NET application that parses attacker-supplied XML (e.g., SignedXml / System.Security.Cryptography.Xml processing) and sends a small, specially crafted request whose processing consumes disproportionately large CPU or memory. Repeating these low-cost requests exhausts server resources and renders the service unavailable to legitimate users. No public exploit was identified at time of analysis, and per the CVSS vector exploitation requires no authentication and no user interaction.