Loading story…
Red Hat has released security updates for multiple .NET and ASP.NET Core vulnerabilities affecting dotnet packages in Red Hat Enterprise Linux 8, 9, and 10, including Extended Update Support and SAP-focused releases. The patched issues include CVE-2026-47300, an ASP.NET Core privilege-escalation flaw caused by an incorrect authentication algorithm; CVE-2026-47303, an authentication-bypass issue tied to assumed-immutable data that can also lead to privilege escalation; CVE-2026-57108, a .NET Core type-confusion bug that allows remote denial of service; and CVE-2026-50651, a .NET HTTP/2 flaw in SocketsHttpHandler Http2Connection where a SETTINGS/PING ACK flood can trigger out-of-memory conditions.
Red Hat rates the ASP.NET Core flaws as Important with CVSS 8.8, while the two denial-of-service issues carry CVSS 7.5 ratings. According to Red Hat, the privilege-escalation bugs can be exploited by an authorized attacker over the network, while the denial-of-service flaws are remotely reachable and require no privileges, with the HTTP/2 issue specifically enabling resource exhaustion through uncontrolled allocation. Fixes were issued through multiple RHSA advisories beginning in July 2026 and extended with additional updates for supported RHEL maintenance channels, including RHEL 10.0 EUS, RHEL 9.6 EUS, and RHEL 9.4 Update Services for SAP Solutions.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
On July 20, 2026, Red Hat released RHSA advisories for RHEL 8, 9, and 10 covering CVE-2026-50651, CVE-2026-47300, CVE-2026-57108, and CVE-2026-47303 across dotnet 8.0, 9.0, and 10.0 package streams. The advisories included RHSA-2026:41893, 41895, 41897, 41899, 41900, 41901, 41894, and 41896.
Red Hat published CVE-2026-47303, an Important-severity ASP.NET Core authentication-bypass flaw that can lead to privilege escalation by manipulating assumed-immutable data. Red Hat assigned it a CVSS v3 score of 8.8 and linked it to Bugzilla 2500502.
Red Hat published CVE-2026-57108, an Important-severity .NET Core type-confusion vulnerability that allows an unauthenticated remote attacker to cause denial of service. The issue is mapped to CWE-843 and linked to Bugzilla 2500109.
Red Hat published CVE-2026-47300, an Important-severity ASP.NET Core privilege-escalation vulnerability caused by an incorrect authentication algorithm implementation. Red Hat assigned it a CVSS v3 score of 8.8 and linked it to Bugzilla 2500492.
Red Hat made public CVE-2026-50651, a .NET denial-of-service flaw involving an HTTP/2 SETTINGS/PING ACK flood that can cause out-of-memory conditions. The issue is associated with Bugzilla 2499217.
On August 24, 2026, Red Hat published additional advisories for RHEL 10.0 Extended Update Support, RHEL 9.4 Update Services for SAP Solutions, and RHEL 9.6 Extended Update Support addressing the same four vulnerabilities. The additional advisories included RHSA-2026:58566, 58567, 58568, 58569, and 58570.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
8 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released a broad set of **Important** security advisories for `.NET 8.0`, `.NET 9.0`, and `.NET 10.0` across **Red Hat Enterprise Linux 8, 9, and 10**, including Extended Update Support, Extended Life Cycle, SAP Solutions, and CodeReady Linux Builder channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The updates deliver refreshed SDK and runtime builds such as `.NET 8.0.130/8.0.30`, `.NET 9.0.120/9.0.19`, and `.NET 10.0.110/10.0.10`, and remediate multiple vulnerability classes affecting .NET and ASP.NET Core, including denial of service, privilege escalation, authentication bypass, security feature bypass, information disclosure, spoofing, tampering, and local code execution. The advisories highlight several notable flaws, including `CVE-2026-50651`, an HTTP/2 `SETTINGS`/`PING ACK` flood issue that can trigger out-of-memory conditions, `CVE-2026-57108`, a .NET Core type-confusion denial-of-service bug, and ASP.NET Core authentication-related privilege escalation issues such as `CVE-2026-47300` and `CVE-2026-47303`. Red Hat said the fixes span numerous RHEL 9.4, 9.6, 10.0, and related support streams, and some packages also include a build-system improvement to reduce the time needed to detect hanging `.NET RPM` builds.
Aug 24, 2026
Red Hat released **Important** security updates for **.NET 10.0** on **RHEL 8, RHEL 9, and RHEL 10**, updating affected systems to **SDK `10.0.111`** and **Runtime `10.0.11`**. The advisories remediate four vulnerabilities tracked as **`CVE-2026-62899`**, **`CVE-2026-62900`**, **`CVE-2026-62901`**, and **`CVE-2026-62909`**, covering a **security feature bypass**, **information disclosure**, **denial of service**, and **elevation of privilege** in .NET. The fixes span multiple product variants and architectures, including **`x86_64`**, **`s390x`**, **`ppc64le`**, and **`aarch64`**, as well as extended support channels for older enterprise deployments. A related **Miracle Linux 8** advisory, surfaced through a Nessus local security check, flags the same .NET 10.0 and ASP.NET Core 10.0 package set as vulnerable and ties remediation to advisory **`AXSA-2026-1582`**. Tenable said the detection is based on installed package versions rather than active exploitation and noted that **no known exploits are currently available**. Together, the notices indicate coordinated downstream patching of the same four .NET flaws across Red Hat-compatible enterprise Linux distributions.
Aug 21, 2026
Red Hat disclosed and remediated **CVE-2026-50649**, an **Important** .NET vulnerability caused by `CWE-502` deserialization of untrusted data that can allow a local, unauthorized attacker to execute code. The company assigned the flaw a **CVSS v3 score of 7.8** and said exploitation requires local access, low attack complexity, no privileges, and user interaction, with potential impact to confidentiality, integrity, and availability. Affected products included multiple .NET package streams across **Red Hat Enterprise Linux 8, 9, and 10**, along with related extended support variants and **Red Hat Hardened Images**. Red Hat published security errata in July and August to deliver fixes across those product lines, while the underlying weakness reflects a broader class of unsafe deserialization bugs that can let attacker-controlled data trigger unintended object behavior and, in some cases, arbitrary code execution through gadget chains.
Aug 24, 2026