Changeflow GovPing Data Privacy & Cybersecurity Multiple .NET Vulnerabilities Allow DoS and Sec...
Urgent Notice Added Final

Multiple .NET Vulnerabilities Allow DoS and Security Bypass

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR issued advisory CERTFR-2026-AVI-0443 alerting that six vulnerabilities (CVE-2026-23666, CVE-2026-26171, CVE-2026-32178, CVE-2026-32203, CVE-2026-32226, CVE-2026-33116) were discovered in Microsoft .NET affecting versions 8.0, 9.0, and 10.0 on Linux, Mac OS, and Windows, as well as multiple .NET Framework versions. These vulnerabilities allow remote attackers to cause denial of service and bypass security policies. Affected organizations should apply patches per Microsoft security bulletins.

View original document View source feed page

What changed

CERT-FR published advisory CERTFR-2026-AVI-0443 disclosing six vulnerabilities in Microsoft .NET affecting .NET 8.0, 9.0, and 10.0 across all major operating systems, as well as multiple .NET Framework versions (3.5 through 4.8.1). The vulnerabilities enable remote denial of service attacks and security policy bypass. The affected version ranges span from .NET 8.0 versions prior to 8.0.26 through .NET 10.0 versions prior to 10.0.6, and various .NET Framework builds prior to specified thresholds.\n\nOrganizations running any affected .NET versions should immediately apply the corresponding Microsoft security patches. Failure to patch exposes systems to remote exploitation that could result in service disruption or security control circumvention. IT security teams should prioritize patching internet-facing applications and servers running .NET workloads.

What to do next

  1. Apply Microsoft security patches for affected .NET versions (8.0.26+, 9.0.15+, 10.0.6+)
  2. Refer to Microsoft security bulletins for patch acquisition details
  3. Monitor for additional updates from Microsoft

Archived snapshot

Apr 15, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 15 avril 2026 N° CERTFR-2026-AVI-0443 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Microsoft .Net

Gestion du document

| Référence | CERTFR-2026-AVI-0443 |
| Titre | Multiples vulnérabilités dans Microsoft .Net |
| Date de la première version | 15 avril 2026 |
| Date de la dernière version | 15 avril 2026 |
| Source(s) | Bulletin de sécurité Microsoft .Net CVE-2026-23666 du 14 avril 2026
Bulletin de sécurité Microsoft .Net CVE-2026-26171 du 14 avril 2026
Bulletin de sécurité Microsoft .Net CVE-2026-32178 du 14 avril 2026
Bulletin de sécurité Microsoft .Net CVE-2026-32203 du 14 avril 2026
Bulletin de sécurité Microsoft .Net CVE-2026-32226 du 14 avril 2026
Bulletin de sécurité Microsoft .Net CVE-2026-33116 du 14 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Contournement de la politique de sécurité
  • Déni de service à distance

Systèmes affectés

  • .NET 10.0 installé sur Linux versions antérieures à 10.0.6
  • .NET 10.0 installé sur Mac OS versions antérieures à 10.0.6
  • .NET 10.0 installé sur Windows versions antérieures à 10.0.6
  • .NET 8.0 installé sur Linux versions antérieures à 8.0.26
  • .NET 8.0 installé sur Mac OS versions antérieures à 8.0.26
  • .NET 8.0 installé sur Windows versions antérieures à 8.0.26
  • .NET 8.0 versions antérieures à 8.0.26
  • .NET 9.0 installé sur Linux versions antérieures à 9.0.15
  • .NET 9.0 installé sur Mac OS versions antérieures à 9.0.15
  • .NET 9.0 installé sur Windows versions antérieures à 9.0.15
  • Microsoft .NET Framework 3.5 et 4.7.2 versions antérieures à 2.0.50727.9068, 3.0.30729.9065 et 4.7.4141.0
  • Microsoft .NET Framework 3.5 et 4.8 versions antérieures à 2.0.50727.9068, 3.0.30729.9065 et 4.8.4801.0
  • Microsoft .NET Framework 3.5 et 4.8 versions antérieures à 2.0.50727.9181, 3.0.30729.9165 et 4.8.4801.0
  • Microsoft .NET Framework 3.5 et 4.8.1 versions antérieures à 2.0.50727.9181, 3.0.30729.9165 et 4.8.9332.0
  • Microsoft .NET Framework 3.5 versions antérieures à 2.0.50727.8982 et 3.0.30729.8976
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 versions antérieures à 4.7.4141.0
  • Microsoft .NET Framework 4.8 versions antérieures à 4.8.4801.0

Résumé

De multiples vulnérabilités ont été découvertes dans Microsoft .Net. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 15 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Security Vulnerabilities in Python Allow Security Bypass
Priority review Apr 13, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Tenable Security Center Allow Remote Code Execution
Priority review Apr 10, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Ubuntu Linux Kernel Vulnerabilities Allow Privilege Escalation
Priority review Apr 10, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 15th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0443

Who this affects

Applies to
Technology companies Manufacturers
Industry sector
5112 Software & Technology
Activity scope
Software patching Vulnerability remediation Server administration
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Software & Technology

Browse Categories

Agriculture & Food Safety 64 AI Regulation 3 Banking & Finance 292 Consumer Protection 44 Courts & Legal 361 Data Privacy & Cybersecurity 73 Defense & National Security 51 Education 19 Energy 100 Environment 86 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Healthcare 136 Housing 16 Immigration 8 Insurance 58 Labor & Employment 113 Legal & Judicial 2 Pharma & Drug Safety 104 Public Health 2 Securities & Markets 103 Securities Regulation 6 Tax 65 Telecom & Technology 47 Trade & Sanctions 135 Transportation 57

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!