CVE-2026-70007HighCVSS 8.8

.NET Framework Remote Code Execution Vulnerability

Published
October 13, 2026
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2026-70007 →

📋 Description

Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

🎯 Affected products33

  • .NET 10.0 installed on Windows
  • .NET 11.0 installed on Windows
  • .NET 8.0 installed on Windows
  • .NET 9.0 installed on Windows
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
  • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019
  • Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
  • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
  • Microsoft .NET Framework 3.5 on Windows 11 version 26H1
  • Microsoft .NET Framework 3.5 on Windows Server 2012
  • Microsoft .NET Framework 3.5 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012
  • Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows 10 version 1607
  • Microsoft .NET Framework 4.8 on Windows Server 2012
  • Microsoft .NET Framework 4.8 on Windows Server 2012 R2
  • Microsoft .NET Framework 4.8 on Windows Server 2016
  • +3 more not shown

✅ Remediation

KB5127660 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 KB5127664 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 KB5130034 (Security Update) — fixed build 8.0.32 KB5130035 (Security Update) — fixed build 9.0.21 KB5130036 (Security Update) — fixed build 10.0.13 KBRelease Notes (Security Update) — fixed build 18.10.4 KB5127689 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127690 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127691 (Security Update) — fixed build 4.8.9363.0 KB5127692 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127694 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0 KB5127684 (Security Update) — fixed build 4.8.4811.0 KB5127686 (Security Update) — fixed build 4.8.4811.0 KB5127688 (Security Update) — fixed build 4.8.4811.0 KB5127685 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 KB5127687 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0 KB5127667 (Security Update) — fixed build 4.7.4150.0 KB5127668 (Security Update) — fixed build 4.7.4150.0 KBRelease Notes (Security Update) — fixed build 17.14.42 KBRelease Notes (Security Update) — fixed build 11.0.0-rc.2 KB5126868 (Security Update) — fixed build 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 KB5127693 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 KB5127696 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 KB5127666 (Security Update) — fixed build 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 KB5127683 (Security Update) — fixed build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.4811.0

🔗 References (46)