Microsoft .NET Framework CVE-2026-97801

Exploitation requires a .NET Framework application that accepts and processes attacker-supplied input of the specific type affected by the improper type validation (CWE-1287) and exposes that processing over the network; per the CVSS vector no authentication, privileges, or user interaction are needed (PR:N/UI:N/AC:L). The practical limiting factor is that the target must actually deserialize or parse the vulnerable input type over a reachable interface - the description does not name the exact feature/API, so the affected component must be confirmed against Microsoft's MSRC advisory. Impact is limited to data/integrity tampering (I:H); there is no confidentiality or availability effect (C:N/A:N), and affected builds are bounded by the EUVD version ranges (e.g., 4.8 below 4.8.4811.0, 4.8.1 below 4.8.9363.0).

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5 HIGH) describes an easily reachable flaw: network-exploitable, low attack complexity, no privileges and no user interaction, with impact confined to integrity (C:N/A:N). This is an integrity-tampering issue, not a confidentiality breach or DoS, which tempers the raw score. No EPSS probability was supplied, so exploitation likelihood cannot be quantified from the input. There is no CISA KEV listing and no public POC in the provided data, so this is 'no public exploit identified at time of analysis' - distinct from active exploitation. SSVC inputs (automatable, exploitation status) were not provided and cannot be asserted. Net assessment: the combination of zero-prerequisite network reachability and the near-ubiquitous deployment of .NET Framework on Windows makes this a credible patch priority, but the integrity-only impact and absence of any exploitation signal (no KEV, no POC, no EPSS) argue against emergency-level urgency. Note also a labeling tension: the input Tag says 'Authentication Bypass' while the description and CVSS (I:H only) describe tampering - verify the precise security impact with Microsoft's MSRC advisory.

A remote, unauthenticated attacker sends crafted input whose declared type is improperly validated by a .NET Framework application exposed over the network, causing the application to accept and act on tampered data it should have rejected. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the request can be delivered directly to any reachable endpoint that processes the affected input type. No public exploit code is identified in the available data.