Loading vulnerability…
WDAC Bypass in Microsoft .NET Framework
CVE-2026-108398 is an untrusted search path vulnerability in Microsoft .NET Framework that allows an authenticated local attacker to bypass Windows Defender Application Control (WDAC) enforcement. An attacker with low privileges can place a specially crafted .NET assembly on an affected system and register it for loading by a protected process, enabling attacker-controlled code to execute within that process without user interaction. Affected configurations include .NET Framework 3.5 and versions in the 4.6.2–4.8.1 families on specified Windows client and server releases. Microsoft rates the vulnerability Important, with a CVSS v3.1 base score of 8.8. It was publicly disclosed before patch availability, but Microsoft reported no exploitation at initial publication.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation bypasses WDAC application-control enforcement, allowing unauthorized code to run within a protected process. This undermines application execution restrictions and can compromise confidentiality, integrity, and availability beyond the vulnerable component's security authority. The CVSS assessment rates all three impacts as High; it does not establish a specific resulting privilege level.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround or compensating control is currently available in the supplied vulnerability details. Apply the official security update rather than relying on WDAC alone to prevent this exploitation technique.
Patch, then assume compromise.
Install the applicable Microsoft .NET Framework security updates released on October 13, 2026, or superseding updates. Select the update packages for the installed Windows release, .NET Framework version, and servicing branch using Microsoft's Security Update Guide. Where multiple .NET Framework components are installed together, apply all applicable component updates rather than treating individual fixed-build thresholds as interchangeable. Complete any required restart.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.