Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Visual Studio and .NET Framework allow security feature bypass

CVE-2026-47304 · published 3 months ago
Summary

Certain versions of Visual Studio 2022, Visual Studio 2026, and the .NET Framework 3.5 and 4.7.2 do not correctly check a digital signature, so an attacker on the network could turn off a built‑in protection. This could let unauthorized users gain capabilities that should be blocked. Update the software to the latest patches or apply the vendor’s recommended configuration changes as soon as possible.

What to do
  • Update microsoft system.security.cryptography.xml to version 8.0.3.416102.
  • Update rootio.system.security.cryptography.xml to version 8.0.3.120072.
  • Update microsoft system.security.cryptography.xml to version 8.0.3.41610.3.
  • Update rootio.system.security.cryptography.xml to version 8.0.3.12007.3.
  • Update microsoft system.security.cryptography.xml to version 10.0.10.
  • Update microsoft system.security.cryptography.xml to version 9.0.18.
  • Update microsoft system.security.cryptography.xml to version 8.0.29.
  • Update microsoft system.security.cryptography.xml to version 8.0.4.
  • Update system.security.cryptography.xml to version 8.0.3.416103.
  • Update rootio.system.security.cryptography.xml to version 8.0.3.416101.
  • Update system.security.cryptography.xml to version 8.0.3.416104.
  • Update rootio.system.security.cryptography.xml to version 8.0.3.120074.
  • Update microsoft microsoft visual studio 2022 version 17.12 to version 17.12.22 or later.
  • Update microsoft microsoft visual studio 2022 version 17.14 to version 17.14.36 or later.
  • Update microsoft microsoft visual studio 2026 version 18.7 to version 18.7.4 or later.
  • Update microsoft microsoft .net framework 3.5 to version 2.0.50727.8983 & 3.0.30729.8978 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.7.2 to version 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.8 to version 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0 or later.
  • Update microsoft microsoft .net framework 3.5 and 4.8.1 to version 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0 or later.
  • Update microsoft microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2 to version 4.7.4143.0 or later.
  • Update microsoft microsoft .net framework 4.8 to version 4.8.4803.0 or later.
  • Update microsoft .net 8.0 to version 8.0.29 or later.
  • Update microsoft .net 9.0 to version 9.0.18 or later.
  • Update microsoft microsoft .net framework 4.8.1 to version 4.8.9340.0 or later.
  • Update microsoft visual_studio_2026 to version 18.7.4 or later.
  • Update microsoft .net 10.0 runtime to version 10.0.10 or later.
  • Update microsoft .net 8.0 runtime to version 8.0.29 or later.
  • Update microsoft .net 9.0 runtime to version 9.0.18 or later.
Affected software
Ecosystem VendorProductAffected versions
– microsoft microsoft visual studio 2022 version 17.12 < 17.12.22
– microsoft microsoft visual studio 2022 version 17.14 < 17.14.36
– microsoft microsoft visual studio 2026 version 18.7 < 18.7.4
– microsoft microsoft .net framework 3.5 < 2.0.50727.8983 & 3.0.30729.8978
– microsoft microsoft .net framework 3.5 and 4.7.2 < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
– microsoft microsoft .net framework 3.5 and 4.8 < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
– microsoft microsoft .net framework 3.5 and 4.8.1 < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
– microsoft microsoft .net framework 4.6.2/4.7/4.7.1/4.7.2 < 4.7.4143.0
– microsoft microsoft .net framework 4.8 < 4.8.4803.0
– microsoft microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8) -
– microsoft microsoft visual studio 2019 version 16.11 (includes 16.0 - 16.10) -
– microsoft microsoft visual studio 2026 version 18.5 -
– microsoft .net 10.0 < 10.0.6
< 10.0.10
– microsoft .net 8.0 < 8.0.29
– microsoft .net 9.0 < 9.0.18
– microsoft microsoft .net framework 4.8.1 < 4.8.9340.0
– microsoft .net_framework 4.7
4.7.1
4.8.1
4.8
4.6.2
4.7.2
3.5
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
– microsoft .net >= 8.0.0, < 8.0.29
>= 9.0.0, < 9.0.18
>= 10.0.0, < 10.0.6
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
– microsoft visual_studio_2017 >= 15.0, <= 15.9
cpe:2.3:a:microsoft:visual_studio_2017:*:*:*:*:*:*:*:*
– microsoft visual_studio_2019 >= 16.0, <= 16.11
cpe:2.3:a:microsoft:visual_studio_2019:*:*:*:*:*:*:*:*
– microsoft visual_studio_2022 >= 17.12.0, < 17.12.22
>= 17.14.0, < 17.14.36
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
– microsoft visual_studio_2026 >= 18.7.0, < 18.7.4
18.5.0
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:*:*:*
Root:NuGet microsoft system.security.cryptography.xml < 8.0.3.416102
< 8.0.3.41610.3
Fix: upgrade to 8.0.3.416102
Root:NuGet – rootio.system.security.cryptography.xml < 8.0.3.120072
< 8.0.3.12007.3
< 8.0.3.416101
< 8.0.3.120074
Fix: upgrade to 8.0.3.120072
nuget microsoft system.security.cryptography.xml >= 10.0.0, <= 10.0.9
>= 9.0.0, <= 9.0.17
>= 8.0.0, <= 8.0.28
>= 8.0.0, <= 8.0.3
Fix: upgrade to 10.0.10
Root:NuGet – system.security.cryptography.xml < 8.0.3.416103
< 8.0.3.416104
Fix: upgrade to 8.0.3.416103
– microsoft .net 10.0 runtime < 10.0.10
– microsoft .net 8.0 runtime < 8.0.29
– microsoft .net 9.0 runtime < 9.0.18
Original advisory text
.NET Security Feature Bypass Vulnerability
Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-345Insufficient Verification of Data Authenticity
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published14 Jul 2026
Updated28 Oct 2026
First seen14 Jul 2026
Sources
CVE-2026-47304 · NVD
CVE-2026-47304 · MITRE
GHSA-g8r8-53c2-pm3f · GHSA
ROOT-APP-NUGET-CVE-2026-47304 · OSV
Track software like this
Free during beta