Microsoft .NET Framework vulnerabilities

206 CVEs affecting Microsoft .NET Framework, 5 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97788, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-0646: Microsoft .NET Framework Remote Code Execution Vulnerability, published 2020-01-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
• CVE-2024-29059: Microsoft .NET Framework Information Disclosure Vulnerability, published 2024-03-23. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2025-02-04. EPSS: 98.6% chance of exploitation in the next 30 days. .NET Framework Information Disclosure Vulnerability
• CVE-2020-1147: Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability, published 2020-07-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 94% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework,…
• CVE-2017-8759: Microsoft .NET Framework Remote Code Execution Vulnerability, published 2017-09-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 88.7% chance of exploitation in the next 30 days. Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application, aka ".NET Framework Remote Code…
• CVE-2015-1671: Microsoft Windows Remote Code Execution Vulnerability, published 2015-05-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-25. EPSS: 49% chance of exploitation in the next 30 days. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010…
• CVE-2013-3861, published 2013-10-09. High severity, CVSS 7.8. EPSS: 82.4% chance of exploitation in the next 30 days. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka…
• CVE-2023-36899, published 2023-08-08. High severity, CVSS 8.8. EPSS: 76.7% chance of exploitation in the next 30 days. ASP.NET Elevation of Privilege Vulnerability
• CVE-2007-0042, published 2007-07-10. High severity, CVSS 7.8. EPSS: 76.2% chance of exploitation in the next 30 days. Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain…
• CVE-2014-0257, published 2014-02-12. High severity, CVSS 9.3. EPSS: 69.8% chance of exploitation in the next 30 days. Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine whether it is safe to execute a method, which allows remote attackers to execute…
• CVE-2010-3332, published 2010-09-22. Medium severity, CVSS 6.4. EPSS: 68.2% chance of exploitation in the next 30 days. Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes during decryption…

Latest

• CVE-2026-97788, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96960, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96959, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96958, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-70354, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
• CVE-2026-65810, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-62897, published 2026-08-11. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
• CVE-2026-62872, published 2026-08-11. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Incorrect authorization in .NET Framework allows an authorized attacker to elevate privileges over a network.
• CVE-2026-50659, published 2026-07-14. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
• CVE-2026-50650, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.