Red Hat has issued security advisories addressing four vulnerabilities in .NET Core: CVE-2026-62899 (security feature bypass), CVE-2026-62900 (information disclosure), CVE-2026-62901 (denial of service), and CVE-2026-62909 (elevation of privilege). These affect .NET Core runtimes and SDKs on Red Hat Enterprise Linux versions 8, 9, and 10 across multiple architectures including x86_64, aarch64, s390x, and ppc64le. The advisories provide updated SDK and runtime packages (e.g., SDK 9.0.120 and Runtime 9.0.19, SDK 10.0.111 and Runtime 10.0.11) that resolve these vulnerabilities. The updates cover Red Hat Hardened Images and various Red Hat Enterprise Linux AppStream and CodeReady Linux Builder repositories. The vendor advisory is the authoritative source for patch availability and remediation instructions.

The vulnerabilities include a security feature bypass that could allow attackers to circumvent security controls, information disclosure that could expose sensitive data, denial of service that could disrupt service availability, and elevation of privilege that could allow unauthorized privilege escalation. These issues collectively pose a high security risk to affected systems running vulnerable .NET Core versions on Red Hat Enterprise Linux. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released updated .NET Core SDK and runtime packages that address these vulnerabilities. Users should apply the updates as detailed in the Red Hat advisories RHSA-2026:54550 and RHSA-2026:55142. The advisories include instructions and links for obtaining and installing the fixed packages. Applying these updates is the recommended and official remediation. No additional mitigation steps are indicated by the vendor.