CVE-2026-70354

.NET Core Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 28th percentile. Fixed versions are out.

CVSS 3.17.8High EPSS percentile28th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix5 products5 fixed builds listed below

Published 2026-08-11Updated 2026-08-17Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Microsoft .NET 10.0Affected: ≥ 10.0.0, < 10.0.11Upgrade to: 10.0.11Stated by: CVE record
Microsoft .NET 8.0Affected: ≥ 8.0.0, < 8.0.30Upgrade to: 8.0.30Stated by: CVE record
Microsoft .NET 9.0Affected: ≥ 9.0.0, < 9.0.19Upgrade to: 9.0.19Stated by: CVE record
Microsoft .NET Framework 3.5Affected: ≥ 3.5.0, < 2.0.50727.8984 & 3.0.30729.8980Upgrade to: 2.0.50727.8984 & 3.0.30729.8980Stated by: CVE record
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2Affected: ≥ 3.0.0.0, < 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4144.0Upgrade to: 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4144.0Stated by: CVE record

Versions as the sources state them. 11 more products have version data. Full version matrix after sign-in

Steps

Written by AI from the record

Check which .NET (10.0/9.0/8.0) or Microsoft .NET Framework 3.5/4.6.2/4.7.x/4.8/4.8.1 versions are installed and used by your apps.
Check whether your users can open or run untrusted content (downloads, email attachments, files from the web, macros/add-ins, or documents that launch apps using .NET).
Upgrade .NET to the fixed releases: .NET 10.0 → 10.0.11, .NET 9.0 → 9.0.19, .NET 8.0 → 8.0.30.
Upgrade .NET Framework to the fixed releases for your branch (3.5, 4.6.2/4.7.x, 4.8, or 4.8.1) using the fixed versions listed in this advisory.
If you use Visual Studio 2022, update it to 17.14.38.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

In plain language

Written by AI from the record

CVE-2026-70354 is a .NET problem that lets a person who can trick someone into opening/running a specially crafted file or input take over that PC; small businesses should treat it as high priority if you run affected .NET/Visual Studio versions.

CVE-2026-70354 is a local arbitrary code execution vulnerability in affected .NET runtimes/frameworks where a crafted local input can trigger an out-of-bounds memory write (CWE-787), resulting in full takeover of the victim machine; no authentication is required, but it needs user interaction to open/run the input.

If you're affected

Full PC takeover
Malware installation risk
Data theft from affected apps
System disruption

What is it

This vulnerability is in the .NET software many apps rely on. If someone can trick a user into opening or running a specially prepared file/input, it can cause the .NET system to write into memory it shouldn’t, leading to full takeover of that device—like giving an attacker a back door that runs under your user’s context.

Who is affected

This matters if your business runs apps built on affected .NET versions (including .NET 8.0/9.0/10.0 and older Microsoft .NET Framework branches) or if your developers/teams use affected Visual Studio 2022 versions. It is triggered by user interaction: a local attacker needs to get a victim to open or run a specific input. There’s no authentication required from the attacker, but it only becomes a real risk when the attacker can reach the right machine and the victim can be induced to run the crafted input.

How urgent is it

Verdict is RED because the vulnerability can lead to arbitrary code execution on the victim machine and full control of the device once the attacker gets the user to open/run the crafted input. Even though it needs user interaction and there’s no KEV listing for this CVE, the combination of “local code execution + user trick required” is exactly how many real intrusions start.

What to do — in detail

Confirm exposure (what to check)

Inventory your installed and in-use runtimes:
- Check Windows machines for installed .NET 10.0 / 9.0 / 8.0 runtime versions.
- Check which Microsoft .NET Framework 3.5 and which 4.6.2/4.7.2/4.8/4.8.1 branches your apps depend on.
- If you use development tooling, check Visual Studio 2022 version.
Determine whether your environment creates an opportunity for “open/run crafted input”:
- Users downloading and opening files (email attachments, web downloads, shared drives).
- Any workflow where users run documents or scripts that launch .NET-based programs.
- Any business process that accepts files from customers/vendors.

Apply the fix (target versions)

Upgrade to the fixed versions provided:

.NET 10.0 → fixed in 10.0.11
.NET 9.0 → fixed in 9.0.19
.NET 8.0 → fixed in 8.0.30

For Microsoft .NET Framework:

.NET Framework 3.5 → fixed in 2.0.50727.8984 & 3.0.30729.8980
.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 → fixed in 2.0.50727.8984 & 3.0.30729.8980 & 4.7.4144.0
.NET Framework 3.5 AND 4.7.2 → fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.7.4144.0
.NET Framework 3.5 AND 4.8 → fixed in 2.0.50727.9070 & 3.0.30729.9068 & 4.8.4805.0
.NET Framework 3.5 AND 4.8.1 → fixed in 2.0.50727.9183 & 3.0.30729.9169 & 4.8.9343.0
.NET Framework 4.6.2/4.7/4.7.1/4.7.2 → fixed in 4.7.4144.0
.NET Framework 4.8 → fixed in 4.8.4805.0
.NET Framework 4.8.1 → fixed in 4.8.9344.0

Visual Studio 2022 (if applicable):

fixed in 17.14.38

Rollout notes / what to watch

Patch both developer workstations and any machines running production apps; this bug affects runtime/framework usage.
After upgrading, re-check the exact versions to confirm the fixed releases are present.

Temporary workaround if patching is delayed

Reduce the chance that users will open/run untrusted files or inputs (tighten download/file-handling rules, block risky attachment types, and restrict who can execute downloaded content).
Focus on “user interaction” risk: preventing users from running the crafted input is the main mitigation until patched.

Due date / known exploitation

No KEV listing is provided for CVE-2026-70354.
A public report mentions active exploitation for a different CVE (CVE-2026-68820) during an August 2026 Patch Tuesday cycle, but the provided snippets do not link that exploitation to CVE-2026-70354.

Technical context

CVE-2026-70354 is a high-severity (RED verdict) local arbitrary code execution issue affecting .NET 10.0/9.0/8.0 and multiple .NET Framework branches (including 3.5, 4.6.2, 4.7.x, 4.8, 4.8.1). The underlying weakness is CWE-787 (out-of-bounds write). Triggering condition in the findings: an attacker can induce the victim to open or run a specific input locally; authentication is not required, but user interaction is. Impact is full code execution on the system (compromise, data access, and disruption).

Fixes are available for each affected branch (e.g., .NET 10.0 fixed in 10.0.11; .NET 9.0 fixed in 9.0.19; .NET 8.0 fixed in 8.0.30; multiple .NET Framework fixed build numbers; Visual Studio 2022 fixed in 17.14.38). KEV does not list this CVE, and no public exploit code is noted in the findings; however, press attention indicates a patch cycle relevant to this class of issues, and exploitation for a different CVE (CVE-2026-68820) is mentioned in the provided news text, not for CVE-2026-70354.

EPSS is present in the findings as a prediction, but public handling of EPSS is not used to drive the urgency decision here because the overarching verdict is RED and there is at least some real-world exploitation chatter tied to the broader patch cycle (for a different CVE).

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS28th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 28th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 6 days, from the signal feeds we watch.

2026-08-17Patch availablerecord updated
2026-08-15OpenVAS check added
2026-08-12Record updated
2026-08-11Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US
- .NET 10.0On-premOperating Systems / windows
- .NET 8.0LibraryLibraryOSS Libraries / generic-library
- .NET 9.0LibraryMixedOSS Libraries / generic-library
- Microsoft .NET Framework 3.5LibraryOn-premOSS Libraries / generic-library
- Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2LibraryLibraryOperating Systems / windows
- Microsoft .NET Framework 3.5 AND 4.7.2LibraryLibraryOSS Libraries / generic-library
- Microsoft .NET Framework 3.5 AND 4.8LibraryLibraryOSS Libraries / generic-library
- Microsoft .NET Framework 3.5 AND 4.8.1LibraryLibraryOSS Libraries / generic-library

And 9 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable