CVE-2026-47304

Summary

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Affected Software

VendorProductVersion RangeStatus
Microsoft.NET 10.010.0.0 < 10.0.10affected
Microsoft.NET 8.08.0.0 < 8.0.29affected
Microsoft.NET 9.09.0.0 < 9.0.18affected
MicrosoftMicrosoft .NET Framework 3.53.5.0 < 2.0.50727.8983 & 3.0.30729.8978affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.7.24.7.0 < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.84.8.0 < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0affected
MicrosoftMicrosoft .NET Framework 3.5 AND 4.8.14.8.1 < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0affected
MicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.24.7.0 < 4.7.4143.0affected
MicrosoftMicrosoft .NET Framework 4.84.8.0 < 4.8.4803.0affected
MicrosoftMicrosoft .NET Framework 4.8.14.8.0.0 < 4.8.9340.0affected
MicrosoftMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)-affected
MicrosoftMicrosoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)-affected
MicrosoftMicrosoft Visual Studio 2022 version 17.1217.12.0 < 17.12.22affected
MicrosoftMicrosoft Visual Studio 2022 version 17.1417.14.0 < 17.14.36affected
MicrosoftMicrosoft Visual Studio 2026 version 18.5-affected
MicrosoftMicrosoft Visual Studio 2026 version 18.718.0 < 18.7.4affected

Weaknesses

  • CWE-347: CWE-347: Improper Verification of Cryptographic Signature
  • CWE-345: CWE-345: Insufficient Verification of Data Authenticity

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References