Patch Forecast
Amber warning
Patch this week.

CVE-2026-70174 · GHSA-f749-vhgx-39h6

Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

Risk score
80/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.9%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
Affected
Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >= 8.0.0, <= 8.0.31; Microsoft.WindowsDesktop.App.Runtime.win-x64 (nuget) >= 8.0.0, <= 8.0.31; Microsoft.WindowsDesktop.App.Runtime.win-x86 (nuget) >= 8.0.0, <= 8.0.31; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >= 9.0.0, <= 9.0.20
Fix
Upgrade Microsoft.WindowsDesktop.App.Runtime.win-arm64 to 8.0.32 or 9.0.21 or 10.0.13; Microsoft.WindowsDesktop.App.Runtime.win-x64 to 8.0.32 or 9.0.21 or 10.0.13; Microsoft.WindowsDesktop.App.Runtime.win-x86 to 8.0.32 or 9.0.21 (whichever matches your release line) or later.
Exploitation
No known exploitation

Story map

Story map: Microsoft.WindowsDesktop.App.Runtime.win-arm64THE FLAWSTHE FIXCVE-2026-70174Microsoft Security AdvisoryCVE-2026-70174 - .NET andVisual Studio Remote Code…CVSS 8.8 · EPSS 1%CVE-2026-70035Microsoft Security AdvisoryCVE-2026-70035 - .NET andVisual Studio Remote Code…CVSS 8.8 · EPSS 1%CVE-2026-83520Microsoft Security AdvisoryCVE-2026-83520 - .NET andVisual Studio Remote Code…CVSS 8.8 · EPSS 1%CVE-2026-96235Microsoft Security AdvisoryCVE-2026-96235 - .NET andVisual Studio Remote Code…CVSS 8.8 · EPSS 1%FixUpgradeMicrosoft.WindowsDesktop.App.Runtime.win-arm64 to 10.0.13or 8.0.32 or 9.0.21…Who is exposedMicrosoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >=10.0.0, <= 10.0.12;Microsoft.WindowsDesktop.App.Runtime.win-x64 (nuget) >=…RED · ACT TODAYMicrosoft.WindowsDesktop.App.Ru…Deserialization of untrusteddata in .NET Framework allowsan unauthorized attacker toexecute code over a network.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-358 (CWE-358)3 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft.WindowsDesktop.App.Runtime.win-arm64: Red, act today. Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

The flaws

  • CVE-2026-70174: Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
  • CVE-2026-70035: Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
  • CVE-2026-83520: Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
  • CVE-2026-96235: Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)

The fix

Fix: Upgrade Microsoft.WindowsDesktop.App.Runtime.win-arm64 to 10.0.13 or 8.0.32 or 9.0.21; Microsoft.WindowsDesktop.App.Runtime.win-x64 to 10.0.13 or 8.0.32 or 9.0.21; Microsoft.WindowsDesktop.App.Runtime.win-x86 to 10.0.13 or 8.0.32 (whichever matches your release line) or later.

Who is exposed: Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >= 10.0.0, <= 10.0.12; Microsoft.WindowsDesktop.App.Runtime.win-x64 (nuget) >= 10.0.0, <= 10.0.12; Microsoft.WindowsDesktop.App.Runtime.win-x86 (nuget) >= 10.0.0, <= 10.0.12; Microsoft.WindowsDesktop.App.Runtime.win-arm64 (nuget) >= 8.0.0, <= 8…

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 8.8 high
  • Remotely exploitable without logging in
  • On your watchlist: .net, NuGet

Affected packages

PackageEcosystemVulnerableFixed in
Microsoft.WindowsDesktop.App.Runtime.win-arm64nuget>= 8.0.0, <= 8.0.318.0.32
Microsoft.WindowsDesktop.App.Runtime.win-x64nuget>= 8.0.0, <= 8.0.318.0.32
Microsoft.WindowsDesktop.App.Runtime.win-x86nuget>= 8.0.0, <= 8.0.318.0.32
Microsoft.WindowsDesktop.App.Runtime.win-arm64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.WindowsDesktop.App.Runtime.win-x64nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.WindowsDesktop.App.Runtime.win-x86nuget>= 9.0.0, <= 9.0.209.0.21
Microsoft.WindowsDesktop.App.Runtime.win-arm64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.WindowsDesktop.App.Runtime.win-x64nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.WindowsDesktop.App.Runtime.win-x86nuget>= 10.0.0, <= 10.0.1210.0.13
Microsoft.WindowsDesktop.App.Runtime.win-arm64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-x64nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2
Microsoft.WindowsDesktop.App.Runtime.win-x86nuget>= 11.0.0-preview.1, <= 11.0.0-rc.111.0.0-rc.2

References

Original description

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

Last activity 13 Oct 2026. Patch Forecast updates every hour.