CVE-2026-108398HighCVSS 8.8

.NET Framework Security Feature Bypass Vulnerability

Published
October 13, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-108398 →

📋 Description

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

🎯 Affected products24

  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows 10 version 1607
  • Microsoft .NET Framework 4.8 on Windows Server 2012
  • Microsoft .NET Framework 4.8 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows Server 2016
  • Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1

✅ Remediation

KB5126868 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 KB5127666 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 KB5127685 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 KB5127683 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127687 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127667 (Security Update) — fixed build 4.7.4150.0 KB5127668 (Security Update) — fixed build 4.7.4150.0 KB5127684 (Security Update) — fixed build 4.8.4811.0 KB5127686 (Security Update) — fixed build 4.8.4811.0 KB5127688 (Security Update) — fixed build 4.8.4811.0 KB5127689 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127690 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127691 (Security Update) — fixed build 4.8.9363.0 KB5127692 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127693 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127694 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0

🔗 References (33)