CVE-2026-118746
.NET Security Feature Bypass Vulnerability
CVE-2026-118746 is a medium vulnerability (CVSS 6.8) in Microsoft .net 11.0 Installed On Linux, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. Fixed in Microsoft.NETCore.App.Runtime.linux-arm 11.0.0-preview.7.26381.103.
- Severity
- 6.8 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.66%EPSS, 52nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
11.0.0-preview.7.26381.103Microsoft.NETCore.App.Runtime.linux-arm +21 more
Description
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
Discussion
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.linux-armNuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.linux-armNuGet | Source text: > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0Not evaluated |
Microsoft.NETCore.App.Runtime.linux-arm64NuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.linux-arm64NuGet | Source text: > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0Not evaluated |
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.linux-musl-armNuGet | Source text: > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0Not evaluated |
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.linux-musl-arm64NuGet | Source text: > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0Not evaluated |
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.linux-musl-x64NuGet | Source text: > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0Not evaluated |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
Microsoft.NETCore.App.Runtime.linux-x64NuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.linux-x64NuGet | Source text: > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0Not evaluated |
Microsoft.NETCore.App.Runtime.osx-arm64NuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
Microsoft.NETCore.App.Runtime.osx-x64NuGet | 11.0.0-preview.1 up to 11.0.0-preview.7.26381.103 | 11.0.0-preview.7.26381.103 |
dotnet7Ubuntu:22.04:LTS | All versions, plus listed versions 7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1 Show 9 moreShow less7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1 | None known |
dotnet11Ubuntu:26.10 | before 11.0.100-11.0.0-0ubuntu1~26.10.1, plus listed versions 11.0.100-11.0.0~rc1-0ubuntu111.0.100-11.0.0~rc2-0ubuntu1~26.10.111.0.100-11.0.0~rc3-0ubuntu1~26.10.1 | 11.0.100-11.0.0-0ubuntu1~26.10.1 |
dotnet8Ubuntu:22.04:LTS From an advisory covering 15 CVEs | before 8.0.134-8.0.34-0ubuntu1~22.04.1, plus listed versions 8.0.102-8.0.2-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.18.0.103-8.0.3-0ubuntu1~22.04.28.0.105-8.0.5-0ubuntu1~22.04.18.0.107-8.0.7-0ubuntu1~22.04.1 Show 24 moreShow less8.0.108-8.0.8-0ubuntu1~22.04.18.0.110-8.0.10-0ubuntu1~22.04.18.0.111-8.0.11-0ubuntu1~22.04.18.0.112-8.0.12-0ubuntu1~22.04.18.0.114-8.0.14-0ubuntu1~22.04.18.0.115-8.0.15-0ubuntu1~22.04.18.0.116-8.0.16-0ubuntu1~22.04.18.0.117-8.0.17-0ubuntu1~22.04.18.0.118-8.0.18-0ubuntu1~22.04.18.0.119-8.0.19-0ubuntu1~22.04.18.0.120-8.0.20-0ubuntu1~22.04.18.0.121-8.0.21-0ubuntu1~22.04.18.0.122-8.0.22-0ubuntu1~22.04.18.0.123-8.0.23-0ubuntu1~22.04.18.0.124-8.0.24-0ubuntu1~22.04.18.0.125-8.0.25-0ubuntu1~22.04.18.0.126-8.0.26-0ubuntu1~22.04.18.0.127-8.0.27-0ubuntu1~22.04.18.0.128-8.0.28-0ubuntu1~22.04.18.0.129-8.0.29-0ubuntu1~22.04.18.0.130-8.0.30-0ubuntu1~22.04.18.0.131-8.0.31-0ubuntu1~22.04.18.0.132-8.0.32-0ubuntu1~22.04.18.0.133-8.0.33-0ubuntu1~22.04.1 | 8.0.134-8.0.34-0ubuntu1~22.04.1 |
dotnet10Ubuntu:24.04:LTS From an advisory covering 15 CVEs | before 10.0.115-10.0.15-0ubuntu1~24.04.1, plus listed versions 10.0.100-10.0.0-0ubuntu1~24.04.110.0.101-10.0.1-0ubuntu1~24.04.210.0.103-10.0.3-0ubuntu1~24.04.110.0.104-10.0.4-0ubuntu1~24.04.110.0.105-10.0.5-0ubuntu1~24.04.1 Show 9 moreShow less10.0.106-10.0.6-0ubuntu1~24.04.110.0.107-10.0.7-0ubuntu1~24.04.110.0.108-10.0.8-0ubuntu1~24.04.110.0.109-10.0.9-0ubuntu1~24.04.110.0.110-10.0.10-0ubuntu1~24.04.110.0.111-10.0.11-0ubuntu1~24.04.110.0.112-10.0.12-0ubuntu1~24.04.110.0.113-10.0.13-0ubuntu1~24.04.110.0.114-10.0.14-0ubuntu1~24.04.1 | 10.0.115-10.0.15-0ubuntu1~24.04.1 |
dotnet8Ubuntu:24.04:LTS From an advisory covering 15 CVEs | before 8.0.134-8.0.34-0ubuntu1~24.04.1, plus listed versions 8.0.100-8.0.0~rc1-0ubuntu18.0.100-8.0.0~rc2-0ubuntu18.0.100-8.0.0~rc2-0ubuntu28.0.100-8.0.0-0ubuntu18.0.100-8.0.0-0ubuntu2 Show 33 moreShow less8.0.101-8.0.1-0ubuntu18.0.101-8.0.1-0ubuntu28.0.102-8.0.2-0ubuntu18.0.103-8.0.3-0ubuntu28.0.103-8.0.3-0ubuntu38.0.104-8.0.4-0ubuntu18.0.105-8.0.5-0ubuntu1~24.04.18.0.107-8.0.7-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.18.0.108-8.0.8-0ubuntu1~24.04.28.0.110-8.0.10-0ubuntu1~24.04.18.0.111-8.0.11-0ubuntu1~24.04.18.0.112-8.0.12-0ubuntu1~24.04.18.0.114-8.0.14-0ubuntu1~24.04.18.0.115-8.0.15-0ubuntu1~24.04.18.0.116-8.0.16-0ubuntu1~24.04.18.0.117-8.0.17-0ubuntu1~24.04.18.0.118-8.0.18-0ubuntu1~24.04.18.0.119-8.0.19-0ubuntu1~24.04.18.0.120-8.0.20-0ubuntu1~24.04.18.0.121-8.0.21-0ubuntu1~24.04.18.0.122-8.0.22-0ubuntu1~24.04.18.0.123-8.0.23-0ubuntu1~24.04.18.0.124-8.0.24-0ubuntu1~24.04.18.0.125-8.0.25-0ubuntu1~24.04.18.0.126-8.0.26-0ubuntu1~24.04.18.0.127-8.0.27-0ubuntu1~24.04.18.0.128-8.0.28-0ubuntu1~24.04.18.0.129-8.0.29-0ubuntu1~24.04.18.0.130-8.0.30-0ubuntu1~24.04.18.0.131-8.0.31-0ubuntu1~24.04.18.0.132-8.0.32-0ubuntu1~24.04.18.0.133-8.0.33-0ubuntu1~24.04.1 | 8.0.134-8.0.34-0ubuntu1~24.04.1 |
dotnet10Ubuntu:26.10 From an advisory covering 15 CVEs | before 10.0.115-10.0.15-0ubuntu1~26.10.1, plus listed versions 10.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu110.0.109-10.0.9-0ubuntu110.0.110-10.0.10-0ubuntu3 Show 5 moreShow less10.0.111-10.0.11-0ubuntu110.0.112-10.0.12-0ubuntu110.0.112-10.0.12-0ubuntu210.0.113-10.0.13-0ubuntu1~26.10.110.0.114-10.0.14-0ubuntu1~26.10.1 | 10.0.115-10.0.15-0ubuntu1~26.10.1 |
dotnet11Ubuntu:26.10 From an advisory covering 15 CVEs | before 11.0.100-11.0.0-0ubuntu1~26.10.1, plus listed versions 11.0.100-11.0.0~rc1-0ubuntu111.0.100-11.0.0~rc2-0ubuntu1~26.10.111.0.100-11.0.0~rc3-0ubuntu1~26.10.1 | 11.0.100-11.0.0-0ubuntu1~26.10.1 |
dotnet10Ubuntu:26.04:LTS From an advisory covering 15 CVEs | before 10.0.115-10.0.15-0ubuntu1~26.04.1, plus listed versions 10.0.100-10.0.0~rc1-0ubuntu110.0.100-10.0.0~rc2-0ubuntu110.0.100-10.0.0-0ubuntu110.0.100-10.0.0-0ubuntu210.0.101-10.0.1-0ubuntu1 Show 14 moreShow less10.0.101-10.0.1-0ubuntu210.0.101-10.0.1-0ubuntu310.0.102-10.0.2-0ubuntu110.0.103-10.0.3-0ubuntu110.0.104-10.0.4-0ubuntu110.0.105-10.0.5-0ubuntu110.0.107-10.0.7-0ubuntu1~26.04.110.0.108-10.0.8-0ubuntu1~26.04.110.0.109-10.0.9-0ubuntu1~26.04.110.0.110-10.0.10-0ubuntu1~26.04.110.0.111-10.0.11-0ubuntu1~26.04.110.0.112-10.0.12-0ubuntu1~26.04.110.0.113-10.0.13-0ubuntu1~26.04.110.0.114-10.0.14-0ubuntu1~26.04.1 | 10.0.115-10.0.15-0ubuntu1~26.04.1 |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
What each source reports
CVE List Score used
.NET Security Feature Bypass Vulnerability
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
- Record
CVE-2026-118746- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - Weakness
- CWE-636
- Updated
- 2026-11-10
EUVDEUVD-2026-122252
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
- Record
EUVD-2026-122252- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - Updated
- 2026-11-10
GitHub AdvisoriesGHSA-ff4h-7rhj-jrjf
Microsoft Security Advisory CVE-2026-118746 - .NET Security Feature Bypass Vulnerability
Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components.
Unix Negotiate authentication can accept a request when required channel-binding information is missing.
Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/498
CVSS Details
- Version: 3.1
- Severity: Medium
- Score: 6.8 (base score)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - Weakness: CWE-636
Affected Platforms
- Platforms: Linux, macOS
- Architectures: Arm, Arm64, x64
<a name="affected-packages"></a>Affected Packages
The tables list affected .NET 11 runtime package versions and fixed versions. The issue occurs during server-side Negotiate authentication with PolicyEnforcement.Always when the client omits the channel-binding token.
.NET 11.0 - Linux runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.linux-arm | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-arm | > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-arm64 | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-arm64 | > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm | > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-arm64 | > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-x64 | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-musl-x64 | > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-x64 | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.linux-x64 | > 11.0.0-preview.7.26381.103, < 11.0.0 | 11.0.0
The six Linux runtime packages at version 11.0.0-preview.7.26381.103 reject PolicyEnforcement.Always before authentication and are not affected.
.NET 11.0 - macOS runtime packages
Package | Affected version | Patched version --- | --- | --- Microsoft.NETCore.App.Runtime.osx-arm64 | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0 Microsoft.NETCore.App.Runtime.osx-x64 | >= 11.0.0-preview.1, < 11.0.0-preview.7.26381.103 | 11.0.0
The macOS runtime packages at versions 11.0.0-preview.7.26381.103, 11.0.0-rc.1.26425.128, 11.0.0-rc.2.26504.105, and 11.0.0-rc.3.26522.148 reject PolicyEnforcement.Always before authentication and are not…
- Record
GHSA-ff4h-7rhj-jrjf- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C - Weakness
- CWE-636
- Updated
- 2026-11-10
NVD
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
- Record
CVE-2026-118746- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-636
- Updated
- 2026-11-10
OSVUBUNTU-CVE-2026-118746
Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.
- Record
UBUNTU-CVE-2026-118746- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-12
OSVUSN-9042-1No score
dotnet8, dotnet10, dotnet11 vulnerabilities
Multiple security issues were discovered in .NET and this update includes new upstream .NET versions to fix these issues.
.NET 8 has been updated to 8.0.34 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. .NET 10 has been updated to 10.0.15 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. .NET 11 has been updated to 11.0.0 in Ubuntu 26.10.
In addition to security fixes, the updated packages contain bug fixes, new features, and possibly incompatible changes.
- Record
USN-9042-1- Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | OSV | |
| affected, aliases, facts, references | GitHub Advisories, NVD | |
| cwes, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118746
github.com/dotnet/runtime/security/advisories/GHSA-ff4h-7rhj-jrjf
nvd.nist.gov/vuln/detail/CVE-2026-118746
Show 20 moreShow less
ubuntu.com/security/CVE-2026-118746
cve.org/CVERecord?id=CVE-2026-118746
devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates
Left out here: the rest of 1 source description. The JSON record has them.