Vulnerabilities
CVE-2026-96236: ASP.NET Core Denial of Service – No New Fix Required
Microsoft updated its Security Updates table to add KB article links for ASP.NET Core 11.0 and Visual Studio, but the vulnerability remains fixed in the same builds. Defenders should confirm they are running a patched version and review the KB for details.
What happened
Microsoft identified CVE-2026-96236, a denial‑of‑service flaw in ASP.NET Core. The company updated its Security Updates table to include KB article links for ASP.NET Core 11.0 and Visual Studio, but the underlying fix is unchanged.
Impact
Systems running ASP.NET Core 11.0 that had not applied the original patch could be susceptible to DoS attacks. The vulnerability has already been addressed in the existing fixed builds.
What to do
- Verify that your ASP.NET Core installation is at least version 11.0 and that the latest security updates are applied.
- Review the KB article linked in the Security Updates table for detailed guidance.
- Ensure your Visual Studio environment is updated to the latest patch level.
Related vulnerabilities
CVE-2026-96233: ASP.NET Core Denial‑of‑Service Vulnerability Fixed in Latest .NET Builds
A flaw in ASP.NET Core allows attackers to trigger a denial‑of‑service via crafted HTTP requests. Microsoft has released patches for .NET 6.0 through 11.0; the fix is already in the latest builds. Defenders should verify and apply the updates and monitor for abnormal resource usage.
Read briefing
CVE-2026-70188: ASP.NET Core Security Feature Bypass – Update Table Clarification
Microsoft updated its security updates table to add KB article links for ASP.NET Core 11.0 and Visual Studio. The vulnerability was already fixed; no new patches are required. Defenders should verify that their ASP.NET Core 11.0 deployments are up‑to‑date and review the KB articles for guidance.
Read briefing
CVE-2026-70179: ASP.NET Core Elevation of Privilege – Informational Update
Microsoft has released an informational update for CVE-2026-70179, an elevation of privilege flaw in ASP.NET Core. The update adds download and KB article links for Visual Studio, but the fixed builds remain unchanged. Defenders should verify that their ASP.NET Core deployments are on patched versions and review the updated documentation.
Read briefing
Windows SMB Server DoS Vulnerability (CVE‑2026‑70133) – Immediate Patch Required
An unbounded resource allocation flaw in Windows SMB Server lets remote attackers trigger a denial‑of‑service. The vulnerability affects all Windows Server editions that run SMB. Microsoft has released a patch; administrators should apply it immediately and consider disabling SMB where possible.
Read briefing