CVE-2026-108398
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature…
- Risk score
- 71/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Exploitation reported in the press
In the news
TL;DR
Microsoft patches 1400+ CVEs, including .NET Framework vulnerability CVE-2026-108398, which allows authorized attackers to bypass security feature locally.
- CVE-2026-108398 is a high-severity vulnerability (CVSS 8.8) in .NET Framework.
- SecurityWeek reports that a security feature bypass in .NET Framework was publicly disclosed prior to the patch release.
- Krebs on Security notes that at least 78 of the flaws fixed this month are rated 'critical' and could be exploited with little or no user action.
- Infosecurity Magazine reports that Microsoft's use of AI to find and fix vulnerabilities has led to a surge in patch volume, with 1400+ CVEs patched this month.
AI summary of 2 articles.
Why it is Amber
- CVSS 8.8 high
- On your watchlist: .net
References
Original description
Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Last activity 13 Oct 2026. Patch Forecast updates every hour.