Security Feature Bypass in .NET Framework by Microsoft
CVE-2026-108398

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft .net Framework 3.5 And 4.6.2/4.7/4.7.1/4.7.2
Microsoft .net Framework 3.5 And 4.7.2
Microsoft .net Framework 3.5 And 4.8
Microsoft .net Framework 3.5 And 4.8.1
Vendor
CVE Published:
13 October 2026

Badges

đź‘ľ Exploit Existsđź“° News Worthy

What is CVE-2026-108398?

A vulnerability in the .NET Framework allows an authorized attacker to exploit an untrusted search path. This could lead to the bypassing of certain security features, potentially resulting in unauthorized access or manipulation of sensitive data.

Affected Version(s)

Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 Windows 10 version 1607 3.0.0.0 < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0

Microsoft .NET Framework 3.5 AND 4.7.2 Windows 10 version 1809 4.7.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0

Microsoft .NET Framework 3.5 AND 4.8 Windows 10 version 1809 4.8.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0

News Articles

favicon imageKaspersky

Highlights of Microsoft’s October Patch Release

The update collection published by Microsoft on October 13, 2026 includes a total of 1,414 patches. Here’s what you need to know.

3 days ago

favicon imageDark Reading

Zero-Days Lurk in Microsoft's Overgrown October Patch Tuesday

The scary surprises for the largest security update ever include security bypasses and unauthenticated RCEs.

5 days ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • đź‘ľ

    Exploit known to exist

  • đź“°

    First article discovered by Dark Reading

  • Vulnerability published

  • Vulnerability Reserved

.