CVE-2026-96960: Microsoft .net

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

Affected products

• Microsoft .net: from 8.0.0, before 8.0.5 (fixed in 8.0.5); from 9.0.0, before 9.0.21 (fixed in 9.0.21); from 10.0.0, before 10.0.13 (fixed in 10.0.13); version 11.0.0 only
• Microsoft .NET Framework: version 4.8.1 only; version 4.8 only; version 4.6.2 only; version 4.7 only; version 4.7.1 only; version 4.7.2 only; …

Affected packages

• System.Security.Cryptography.Xml (NuGet)

Published 2026-10-13. Last modified 2026-10-16.