CVE-2026-96957: CWE-347: Improper Verification of Cryptographic Signature in Microsoft .NET 10.0

This vulnerability (CVE-2026-96957) in Microsoft .NET 10.0 is classified under CWE-347, indicating improper verification of cryptographic signatures. The flaw enables an attacker to bypass security mechanisms remotely without privileges, potentially leading to full compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Multiple affected version ranges are identified, and Microsoft has issued an official fix.

Successful exploitation allows an attacker to bypass cryptographic signature verification, undermining security controls and potentially leading to unauthorized access or execution of malicious actions. The impact includes full compromise of confidentiality, integrity, and availability of affected systems running vulnerable .NET versions.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96957 to remediate this vulnerability.