Loading story…
Microsoft published security advisories for two Important remote denial-of-service (DoS) vulnerabilities affecting .NET and ASP.NET Core: CVE-2026-26127 and CVE-2026-26130. Both issues are scored CVSS 3.1 7.5 with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network-reachable exploitation with low complexity, no privileges, and no user interaction, resulting in high availability impact.
CVE-2026-26127 is described as a .NET DoS condition associated with CWE-125 (Out-of-bounds Read), while CVE-2026-26130 is an ASP.NET Core DoS issue associated with CWE-770 (Allocation of Resources Without Limits or Throttling). Organizations running internet-exposed or high-availability services on these frameworks should prioritize applying Microsoft’s updates and review service-level protections (e.g., request throttling and resource limits) where applicable to reduce DoS risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft released security updates to address CVE-2026-26127, recommending upgrades to .NET 9.0.14 and 10.0.4 and updates to affected Microsoft.Bcl.Memory packages. Public details had been disclosed by an anonymous researcher, but reporting said there was no evidence of active exploitation.
Microsoft also published a Security Update Guide entry for CVE-2026-26130, identifying an ASP.NET Core denial-of-service vulnerability. The reference indicates a separate Microsoft disclosure on the same day.
Microsoft disclosed CVE-2026-26127 as a .NET denial-of-service vulnerability in its Security Update Guide. The flaw affects .NET 9.0 and 10.0 and can be triggered remotely without authentication via an out-of-bounds read that crashes vulnerable applications.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemsrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for elevation of privilege vulnerabilities affecting **ASP.NET** and **.NET**, including `CVE-2023-36899` and `CVE-2026-35433`. The newer flaw, `CVE-2026-35433`, affects .NET and stems from improper input validation combined with an integer overflow or wraparound condition that can let an unauthorized attacker elevate privileges locally if a user triggers the malicious payload in an application. Microsoft rated `CVE-2026-35433` as **Important** with a **CVSS 3.1 score of 7.3** and said successful exploitation could result in **SYSTEM** privileges. The company reported that the issue was neither publicly disclosed nor known to be exploited at publication time, assessed exploitation as unlikely, and said fixes were made available through **.NET Framework** updates, while the ASP.NET issue `CVE-2023-36899` was also listed in Microsoft's Security Update Guide as an elevation of privilege vulnerability.
Jun 29, 2026
Microsoft published security advisories for two denial-of-service vulnerabilities affecting widely deployed enterprise software: **CVE-2024-43466** in **Microsoft SharePoint Server** and **CVE-2026-23666** in the **.NET Framework**. Both entries were released through the Microsoft Security Response Center's Security Update Guide, identifying the products and impact category as denial of service. The disclosures indicate that organizations running on-premises SharePoint environments or applications dependent on the .NET Framework should review Microsoft's update guidance and assess exposure across affected systems. While the advisories provided limited public technical detail, the combination of flaws highlights continued risk to core Microsoft infrastructure components that support collaboration platforms and business applications.
Jul 12, 2026
Microsoft disclosed and patched three **Windows TCP/IP denial-of-service vulnerabilities** tracked as `CVE-2026-40405`, `CVE-2026-40413`, and `CVE-2026-40414`. The flaws stem from **NULL pointer dereference** conditions and can be triggered remotely without user interaction, causing high availability impact. Microsoft rated the issues **Important**, assigned CVSS scores of **7.5** for `CVE-2026-40405` and **7.4** for `CVE-2026-40413` and `CVE-2026-40414`, and said none of the vulnerabilities had been publicly disclosed or exploited in the wild at the time of publication. Microsoft said `CVE-2026-40413` and `CVE-2026-40414` are exploitable from an **adjacent network**, limiting attacks to the same network segment such as a shared switch or virtual network, while `CVE-2026-40405` is described as remotely exploitable over the network. The company warned that the adjacent-network flaws may involve a **scope change**, including scenarios in which a low-privilege **Hyper-V guest** could cross the guest boundary and deny service on the Hyper-V host. Microsoft has released official fixes for all three issues, adding to a broader pattern of Windows networking and TCP/IP denial-of-service advisories published in recent update cycles.
Jun 29, 2026