Loading story…
Red Hat disclosed and remediated CVE-2026-50649, an Important .NET vulnerability caused by CWE-502 deserialization of untrusted data that can allow a local, unauthorized attacker to execute code. The company assigned the flaw a CVSS v3 score of 7.8 and said exploitation requires local access, low attack complexity, no privileges, and user interaction, with potential impact to confidentiality, integrity, and availability.
Affected products included multiple .NET package streams across Red Hat Enterprise Linux 8, 9, and 10, along with related extended support variants and Red Hat Hardened Images. Red Hat published security errata in July and August to deliver fixes across those product lines, while the underlying weakness reflects a broader class of unsafe deserialization bugs that can let attacker-controlled data trigger unintended object behavior and, in some cases, arbitrary code execution through gadget chains.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
Red Hat published its CVE database entry for CVE-2026-50649, rating the .NET deserialization flaw as Important with a CVSS v3 score of 7.8. The entry links the issue to CWE-502 and documents affected and fixed Red Hat products.
On July 20, 2026, Red Hat published multiple RHSA advisories fixing CVE-2026-50649 across .NET package streams for Red Hat Enterprise Linux 8, 9, and 10. The advisories covered dotnet 8.0, 9.0, and 10.0 packages across those major versions.
The vulnerability was recorded in OSIDB Bzimport with Bugzilla ID 2500563. The record identifies the issue as local code execution in .NET via deserialization of untrusted data.
Red Hat states that CVE-2026-50649 was public on July 14, 2026. The flaw affects .NET and allows local code execution via deserialization of untrusted data.
Red Hat listed CVE-2026-50649 as fixed for Red Hat Hardened Images dotnet9-0-main in security advisory RHSA-2026:27171. This is the earliest dated remediation mentioned for the .NET deserialization flaw.
Red Hat later published additional errata addressing CVE-2026-50649 for Extended Update Support and SAP-focused RHEL variants, including RHSA-2026:58566 through RHSA-2026:58570. The references state these remediation notices were issued between July 20 and August 24, 2026, but do not anchor individual advisory dates in the content provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat has released security updates for multiple **.NET** and **ASP.NET Core** vulnerabilities affecting `dotnet` packages in **Red Hat Enterprise Linux 8, 9, and 10**, including Extended Update Support and SAP-focused releases. The patched issues include **CVE-2026-47300**, an ASP.NET Core privilege-escalation flaw caused by an incorrect authentication algorithm; **CVE-2026-47303**, an authentication-bypass issue tied to assumed-immutable data that can also lead to privilege escalation; **CVE-2026-57108**, a .NET Core type-confusion bug that allows remote denial of service; and **CVE-2026-50651**, a .NET HTTP/2 flaw in `SocketsHttpHandler Http2Connection` where a `SETTINGS`/`PING ACK` flood can trigger out-of-memory conditions. Red Hat rates the ASP.NET Core flaws as **Important** with **CVSS 8.8**, while the two denial-of-service issues carry **CVSS 7.5** ratings. According to Red Hat, the privilege-escalation bugs can be exploited by an authorized attacker over the network, while the denial-of-service flaws are remotely reachable and require no privileges, with the HTTP/2 issue specifically enabling resource exhaustion through uncontrolled allocation. Fixes were issued through multiple **RHSA** advisories beginning in July 2026 and extended with additional updates for supported RHEL maintenance channels, including **RHEL 10.0 EUS**, **RHEL 9.6 EUS**, and **RHEL 9.4 Update Services for SAP Solutions**.
Aug 24, 2026
Red Hat disclosed **CVE-2026-50526**, a moderate-severity flaw in **.NET** caused by improper link resolution before file access, tracked as **`CWE-59`**. The vulnerability allows an authorized local attacker to exploit link following behavior to tamper with files, potentially modifying application data or system files outside the intended target. Red Hat assigned the issue a **CVSS v3 score of 7.0**, while the NVD scored it **5.5**, reflecting different assessments of the flaw's impact. The weakness matches the broader **link following** class in which software accesses a file path without preventing resolution through symlinks, hard links, shortcuts, or similar mechanisms, creating opportunities for unauthorized read or write operations. Red Hat reported fixes across multiple **RHEL 8, 9, and 10** product lines, including specialized support channels such as **RHEL 10.0 EUS**, **RHEL 9.4 Update Services for SAP Solutions**, and **RHEL 9.6 EUS**, with remediation delivered through RHSA advisories published in July and August 2026.
Aug 24, 2026
Red Hat released a broad set of **Important** security advisories for `.NET 8.0`, `.NET 9.0`, and `.NET 10.0` across **Red Hat Enterprise Linux 8, 9, and 10**, including Extended Update Support, Extended Life Cycle, SAP Solutions, and CodeReady Linux Builder channels on `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The updates deliver refreshed SDK and runtime builds such as `.NET 8.0.130/8.0.30`, `.NET 9.0.120/9.0.19`, and `.NET 10.0.110/10.0.10`, and remediate multiple vulnerability classes affecting .NET and ASP.NET Core, including denial of service, privilege escalation, authentication bypass, security feature bypass, information disclosure, spoofing, tampering, and local code execution. The advisories highlight several notable flaws, including `CVE-2026-50651`, an HTTP/2 `SETTINGS`/`PING ACK` flood issue that can trigger out-of-memory conditions, `CVE-2026-57108`, a .NET Core type-confusion denial-of-service bug, and ASP.NET Core authentication-related privilege escalation issues such as `CVE-2026-47300` and `CVE-2026-47303`. Red Hat said the fixes span numerous RHEL 9.4, 9.6, 10.0, and related support streams, and some packages also include a build-system improvement to reduce the time needed to detect hanging `.NET RPM` builds.
Aug 24, 2026