This vulnerability (CVE-2026-26171) affects Microsoft .NET 10.0 and is related to unsafe transforms in the EncryptedXml component. An attacker can exploit this flaw remotely without authentication to cause uncontrolled resource consumption, leading to a denial of service condition. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-776 (Improper Restriction of Recursive Entity References in DTDs). The CVSS v3.1 base score is 7.5 (high), reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. Microsoft has issued an official fix for this vulnerability.

The vulnerability allows remote attackers to cause a denial of service by exhausting system resources through unsafe XML transforms in EncryptedXml. This results in service unavailability and may also allow bypassing certain security features. There is no impact on confidentiality or integrity. The vulnerability affects availability with a high severity rating.

An official fix is available from Microsoft for this vulnerability. Users should apply the vendor-provided patch to remediate the issue. According to the vendor advisory, no alternative mitigations meet the criteria for ease of use and applicability. Therefore, patching is the recommended and effective mitigation.