This advisory addresses four distinct security vulnerabilities in the .NET 8.0 platform on Red Hat Enterprise Linux 10: CVE-2026-62899 (security feature bypass), CVE-2026-62900 (information disclosure), CVE-2026-62901 (denial of service), and CVE-2026-62909 (elevation of privilege). The update includes an upgrade to SDK version 8.0.130 and runtime version 8.0.30. The vulnerabilities impact the .NET Core runtime and associated libraries, which are used for building console, web applications, and microservices across Linux, macOS, and Windows. The advisory does not provide CVSS scores but classifies the impact as important. The update is available for multiple Red Hat Enterprise Linux 10 variants and architectures.

The vulnerabilities collectively allow attackers to bypass security features, disclose sensitive information, cause denial of service conditions, and elevate privileges within the .NET runtime environment. This could potentially compromise the confidentiality, integrity, and availability of applications running on affected systems. The advisory rates the security impact as important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released an official update that addresses these vulnerabilities by upgrading the .NET SDK to 8.0.130 and runtime to 8.0.30. Users should apply this update promptly to remediate the security issues. Detailed instructions for applying the update are available in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated or required beyond applying the official patch.