CVE-2026-96960

HIGH

MEDIUM Priority: 0.09 BB Relevance: 75/100

Published: 2026-10-13 Modified: 2026-10-30 First seen: 2026-10-29 Status: active

Network Low Complexity No Auth No Interaction

AV: Network

AC: Low

PR: None

UI: None

S: Unchanged

C: None

I: None

A: High

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Vendor	Product	Version
Microsoft	Microsoft .NET Framework 3.5	3.5.0 < 2.0.50727.9188 AND 3.0.30729.9171
Microsoft	Microsoft .NET Framework 3.5	3.5.0 < 2.0.50727.9188 AND 3.0.30729.9171
Microsoft	Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2	3.0.0.0 < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.7.2	4.7.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8	4.8.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0
Microsoft	Microsoft .NET Framework 3.5 AND 4.8.1	4.8.1 < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0
Microsoft	Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2	4.7.0 < 4.7.4150.0
Microsoft	Microsoft .NET Framework 4.8	4.8.0 < 4.8.4811.0
Microsoft	Microsoft .NET Framework 4.8.1	4.8.0.0 < 4.8.9363.0
Microsoft	System.Security.Cryptography.Xml	10.0.0 < 10.0.13
microsoft	.net	8.0.0 – 8.0.5
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net	11.0.0
microsoft	.net_framework	4.8.1
microsoft	.net_framework	4.8
microsoft	.net_framework	4.6.2
microsoft	.net_framework	4.7
microsoft	.net_framework	4.7.1
microsoft	.net_framework	4.7.2
microsoft	.net_framework	3.5

vendor-advisory patch

75 / 100

✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

7.5 / 10.0 v3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

1.20%

Raw Score 0.012030

Percentile 68.2%

Date 2026-10-30

2026-10-30

0.01203

2026-10-29

0.01203

2026-10-28

0.01203

mitre ref →

nvd ref →