Loading story…
Red Hat released Important security updates for .NET 10.0 on RHEL 8, RHEL 9, and RHEL 10, updating affected systems to SDK 10.0.111 and Runtime 10.0.11. The advisories remediate four vulnerabilities tracked as CVE-2026-62899, CVE-2026-62900, CVE-2026-62901, and CVE-2026-62909, covering a security feature bypass, information disclosure, denial of service, and elevation of privilege in .NET. The fixes span multiple product variants and architectures, including x86_64, s390x, ppc64le, and aarch64, as well as extended support channels for older enterprise deployments.
A related Miracle Linux 8 advisory, surfaced through a Nessus local security check, flags the same .NET 10.0 and ASP.NET Core 10.0 package set as vulnerable and ties remediation to advisory AXSA-2026-1582. Tenable said the detection is based on installed package versions rather than active exploitation and noted that no known exploits are currently available. Together, the notices indicate coordinated downstream patching of the same four .NET flaws across Red Hat-compatible enterprise Linux distributions.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
A Miracle Linux 8 advisory, AXSA-2026-1582, was published for affected .NET 10.0 and ASP.NET Core 10.0 packages. The notice references the same four CVEs and is reflected in a Nessus local security check, which states no known exploits are available.
Red Hat published an Important security advisory for .NET 10.0 on Red Hat Enterprise Linux 10, updating the SDK to 10.0.111 and Runtime to 10.0.11. The advisory addresses CVE-2026-62899, CVE-2026-62900, CVE-2026-62901, and CVE-2026-62909 across RHEL 10 channels and architectures.
Red Hat published an Important security advisory for .NET 10.0 on Red Hat Enterprise Linux 9, updating the SDK to 10.0.111 and Runtime to 10.0.11. The advisory fixes the same four .NET vulnerabilities across RHEL 9 product variants and architectures.
Red Hat published an Important security advisory for .NET 10.0 on Red Hat Enterprise Linux 8, updating the SDK to 10.0.111 and Runtime to 10.0.11. The update fixes CVE-2026-62899, CVE-2026-62900, CVE-2026-62901, and CVE-2026-62909 across multiple RHEL 8 variants and architectures.
Fedora issued advisory FEDORA-2026-8b4cb2340a for Fedora 44's dotnet10.0 package. The advisory covers multiple vulnerabilities, including CVE-2026-62899, CVE-2026-62900, CVE-2026-62901, CVE-2026-62909, and additional CVEs such as CVE-2026-70354.
The four .NET vulnerabilities referenced by the advisories were published, covering security feature bypass, information disclosure, denial of service, and elevation of privilege issues. This publication date is explicitly stated in the Miracle Linux Nessus plugin reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcetenable.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security advisories for `.NET 8.0`, `.NET 9.0`, and `.NET 10.0` across **Red Hat Enterprise Linux 8, 9, and 10**, including Extended Update Support, Extended Life Cycle, SAP Solutions, and CodeReady Linux Builder channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The updates deliver refreshed SDK and runtime builds such as `.NET 8.0.130/8.0.30`, `.NET 9.0.120/9.0.19`, and `.NET 10.0.110/10.0.10`, and remediate multiple vulnerability classes affecting .NET and ASP.NET Core, including denial of service, privilege escalation, authentication bypass, security feature bypass, information disclosure, spoofing, tampering, and local code execution. The advisories highlight several notable flaws, including `CVE-2026-50651`, an HTTP/2 `SETTINGS`/`PING ACK` flood issue that can trigger out-of-memory conditions, `CVE-2026-57108`, a .NET Core type-confusion denial-of-service bug, and ASP.NET Core authentication-related privilege escalation issues such as `CVE-2026-47300` and `CVE-2026-47303`. Red Hat said the fixes span numerous RHEL 9.4, 9.6, 10.0, and related support streams, and some packages also include a build-system improvement to reduce the time needed to detect hanging `.NET RPM` builds.
Aug 24, 2026
Red Hat has released security updates for multiple **.NET** and **ASP.NET Core** vulnerabilities affecting `dotnet` packages in **Red Hat Enterprise Linux 8, 9, and 10**, including Extended Update Support and SAP-focused releases. The patched issues include **CVE-2026-47300**, an ASP.NET Core privilege-escalation flaw caused by an incorrect authentication algorithm; **CVE-2026-47303**, an authentication-bypass issue tied to assumed-immutable data that can also lead to privilege escalation; **CVE-2026-57108**, a .NET Core type-confusion bug that allows remote denial of service; and **CVE-2026-50651**, a .NET HTTP/2 flaw in `SocketsHttpHandler Http2Connection` where a `SETTINGS`/`PING ACK` flood can trigger out-of-memory conditions. Red Hat rates the ASP.NET Core flaws as **Important** with **CVSS 8.8**, while the two denial-of-service issues carry **CVSS 7.5** ratings. According to Red Hat, the privilege-escalation bugs can be exploited by an authorized attacker over the network, while the denial-of-service flaws are remotely reachable and require no privileges, with the HTTP/2 issue specifically enabling resource exhaustion through uncontrolled allocation. Fixes were issued through multiple **RHSA** advisories beginning in July 2026 and extended with additional updates for supported RHEL maintenance channels, including **RHEL 10.0 EUS**, **RHEL 9.6 EUS**, and **RHEL 9.4 Update Services for SAP Solutions**.
Aug 24, 2026
Red Hat disclosed and remediated **CVE-2026-50649**, an **Important** .NET vulnerability caused by `CWE-502` deserialization of untrusted data that can allow a local, unauthorized attacker to execute code. The company assigned the flaw a **CVSS v3 score of 7.8** and said exploitation requires local access, low attack complexity, no privileges, and user interaction, with potential impact to confidentiality, integrity, and availability. Affected products included multiple .NET package streams across **Red Hat Enterprise Linux 8, 9, and 10**, along with related extended support variants and **Red Hat Hardened Images**. Red Hat published security errata in July and August to deliver fixes across those product lines, while the underlying weakness reflects a broader class of unsafe deserialization bugs that can let attacker-controlled data trigger unintended object behavior and, in some cases, arbitrary code execution through gadget chains.
Aug 24, 2026