CVE-2026-70194: CWE-295: Improper Certificate Validation in Microsoft .NET 11.0

This vulnerability (CWE-295) in Microsoft .NET 11.0's System.Net.Security component allows the TLS client authentication process to fail in verifying client certificates after the handshake, potentially bypassing mutual TLS authentication requirements. It affects multiple Linux and macOS runtime packages from versions 11.0.0-preview.1 through 11.0.0-rc.1. Microsoft has provided an official fix in version 11.0.0-rc.2. The advisory includes guidance for developers to update their applications and runtime environments accordingly.

The vulnerability can lead to bypassing mutual TLS client authentication, reducing the security of TLS connections by allowing clients to authenticate without proper certificate validation. This could potentially allow unauthorized clients to connect to services expecting mutual authentication. The CVSS 3.1 score is 6.5 (medium severity), reflecting limited confidentiality and integrity impacts without availability impact. No known exploits are reported in the wild.

An official fix is available. Users should update to Microsoft .NET runtime version 11.0.0-rc.2 or later for the affected packages. Applications referencing vulnerable packages must update their package references accordingly. Self-contained applications targeting affected versions must be recompiled and redeployed after updating. Restart applications after applying updates to ensure the fix takes effect.