CVE-2026-70194
Fixed in a distro release EPSS <1%CVSS 6.5
Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network.
Products: Microsoft .NET 11.0 runtime, Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| NuGet | Microsoft.NETCore.App.Runtime.linux-arm | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.linux-arm64 | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.linux-musl-arm | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.linux-musl-arm64 | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.linux-musl-x64 | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.linux-x64 | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.osx-arm64 | 11.0.0-rc.2 |
| NuGet | Microsoft.NETCore.App.Runtime.osx-x64 | 11.0.0-rc.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu 22.04 LTS | dotnet7 | no fix |
| Ubuntu 22.04 LTS | dotnet8 | 8.0.132-8.0.32-0ubuntu1~22.04.1 |
| Ubuntu 24.04 LTS | dotnet10 | 10.0.113-10.0.13-0ubuntu1~24.04.1 |
| Ubuntu 24.04 LTS | dotnet8 | 8.0.132-8.0.32-0ubuntu1~24.04.1 |
| Ubuntu 26.04 LTS | dotnet10 | 10.0.113-10.0.13-0ubuntu1~26.04.1 |
| Ubuntu 26.10 | dotnet10 | 10.0.113-10.0.13-0ubuntu1~26.10.1 |
| Ubuntu 26.10 | dotnet11 | 11.0.100-11.0.0~rc2-0ubuntu1~26.10.1 |