CVE-2018-0786
Improper Certificate Validation in Microsoft .NET Framework components
CVE-2018-0786 is a high vulnerability (CVSS 7.5) in Microsoft .net Core, published January 10, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.69%, the 89th percentile. Fixed in Microsoft.NETCore.UniversalWindowsPlatform 5.2.4.
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
- Record
CVE-2018-0786- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
- Record
CVE-2018-0786- Updated
- 2026-11-02
EUVDEUVD-2018-0631 No score
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
- Record
EUVD-2018-0631- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jc8g-xhw5-6x46
Improper Certificate Validation in Microsoft .NET Framework components
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
- Record
GHSA-jc8g-xhw5-6x46- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
- Record
CVE-2018-0786- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-jc8g-xhw5-6x46
Improper Certificate Validation in Microsoft .NET Framework components
Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, .NET Core 1.0 and 2.0, and PowerShell Core 6.0.0 allow a security feature bypass vulnerability due to the way certificates are validated, aka ".NET Security Feature Bypass Vulnerability."
- Record
GHSA-jc8g-xhw5-6x46- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
5.2.0 up to 5.2.4 | 5.2.4 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
5.3.0 up to 5.3.5 | 5.3.5 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
5.4.0 up to 5.4.2 | 5.4.2 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
6.0.0 up to 6.0.6 | 6.0.6 |
System.ServiceModel.PrimitivesNuGet |
4.4.0 to 4.4.0 | 4.4.1 |
System.ServiceModel.PrimitivesNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.ServiceModel.PrimitivesNuGet |
4.1.0 to 4.1.0 | 4.1.1 |
System.ServiceModel.HttpNuGet |
4.4.0 to 4.4.0 | 4.4.1 |
System.ServiceModel.HttpNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.ServiceModel.HttpNuGet |
4.1.0 to 4.1.0 | 4.1.1 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
System.ServiceModel.NetTcpNuGet |
4.4.0 to 4.4.0 | 4.4.1 |
System.ServiceModel.NetTcpNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.ServiceModel.NetTcpNuGet |
4.1.0 to 4.1.0 | 4.1.1 |
System.ServiceModel.DuplexNuGet |
4.4.0 to 4.4.0 | 4.4.1 |
System.ServiceModel.DuplexNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.ServiceModel.SecurityNuGet |
4.4.0 to 4.4.0 | 4.4.1 |
System.ServiceModel.SecurityNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.Private.ServiceModelNuGet |
4.4.0 to 4.4.0 | 4.4.1 |
System.Private.ServiceModelNuGet |
4.3.0 to 4.3.0 | 4.3.1 |
System.Private.ServiceModelNuGet |
4.1.0 to 4.1.0 | 4.1.1 |
System.ServiceModel.SecurityNuGet |
4.0.1 to 4.0.1 | 4.0.2 |
System.ServiceModel.DuplexNuGet |
4.0.1 to 4.0.1 | 4.0.2 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
5.2.0 up to 5.2.4, plus listed versions 5.2.15.2.25.2.3 |
5.2.4 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
5.3.0 up to 5.3.5, plus listed versions 5.3.15.3.25.3.35.3.4 |
5.3.5 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
5.4.0 up to 5.4.2, plus listed versions 5.4.1 |
5.4.2 |
Microsoft.NETCore.UniversalWindowsPlatformNuGet |
6.0.0 up to 6.0.6, plus listed versions 6.0.16.0.26.0.46.0.5 |
6.0.6 |
System.ServiceModel.PrimitivesNuGet |
4.4.0 up to 4.4.1, plus listed versions 4.4.1-servicing-25917-01 |
4.4.1 |
System.ServiceModel.PrimitivesNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.ServiceModel.PrimitivesNuGet |
4.1.0 up to 4.1.1 | 4.1.1 |
System.ServiceModel.HttpNuGet |
4.4.0 up to 4.4.1 | 4.4.1 |
System.ServiceModel.HttpNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.ServiceModel.HttpNuGet |
4.1.0 up to 4.1.1 | 4.1.1 |
System.ServiceModel.NetTcpNuGet |
4.4.0 up to 4.4.1 | 4.4.1 |
System.ServiceModel.NetTcpNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.ServiceModel.NetTcpNuGet |
4.1.0 up to 4.1.1 | 4.1.1 |
System.ServiceModel.DuplexNuGet |
4.4.0 up to 4.4.1 | 4.4.1 |
System.ServiceModel.DuplexNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.ServiceModel.DuplexNuGet |
4.0.1 up to 4.0.2 | 4.0.2 |
System.ServiceModel.SecurityNuGet |
4.4.0 up to 4.4.1 | 4.4.1 |
System.ServiceModel.SecurityNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.ServiceModel.SecurityNuGet |
4.0.1 up to 4.0.2 | 4.0.2 |
System.Private.ServiceModelNuGet |
4.4.0 up to 4.4.1 | 4.4.1 |
System.Private.ServiceModelNuGet |
4.3.0 up to 4.3.1 | 4.3.1 |
System.Private.ServiceModelNuGet |
4.1.0 up to 4.1.1 | 4.1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0786
securityfocus.com/bid/102380
securitytracker.com/id/1040152
nvd.nist.gov/vuln/detail/CVE-2018-0786
github.com/dotnet/announcements/issues/51
nuget.org/packages/System.ServiceModel.Duplex