CVE-2026-70354

This vulnerability is in the .NET software many apps rely on. If someone can trick a user into opening or running a specially prepared file/input, it can cause the .NET system to write into memory it shouldn’t, leading to full takeover of that device—like giving an attacker a back door that runs under your user’s context.

This matters if your business runs apps built on affected .NET versions (including .NET 8.0/9.0/10.0 and older Microsoft .NET Framework branches) or if your developers/teams use affected Visual Studio 2022 versions. It is triggered by user interaction: a local attacker needs to get a victim to open or run a specific input. There’s no authentication required from the attacker, but it only becomes a real risk when the attacker can reach the right machine and the victim can be induced to run the crafted input.

Verdict is RED because the vulnerability can lead to arbitrary code execution on the victim machine and full control of the device once the attacker gets the user to open/run the crafted input. Even though it needs user interaction and there’s no KEV listing for this CVE, the combination of “local code execution + user trick required” is exactly how many real intrusions start.