MicrosoftCVE-2026-47304

Microsoft .NET 10.0: insufficient authenticity check

High8.1CVE-2026-47304 · Published Jul 14, 2026 · updated Jul 24, 2026

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
.NET 10.0 Product	>= 10.0.0, < 10.0.10	10.0.10
.NET 8.0 Product	>= 8.0.0, < 8.0.29	8.0.29
.NET 9.0 Product	>= 9.0.0, < 9.0.18	9.0.18
Microsoft .NET Framework 3.5 Product	>= 3.5.0, < 2.0.50727.8983 & 3.0.30729.8978	2.0.50727.8983 & 3.0.30729.8978
Microsoft .NET Framework 3.5 AND 4.7.2 Product	>= 4.7.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0	2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0
Microsoft .NET Framework 3.5 AND 4.8 Product	>= 4.8.0, < 2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0	2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0
Microsoft .NET Framework 3.5 AND 4.8.1 Product	>= 4.8.1, < 2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0	2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Product	>= 4.7.0, < 4.7.4143.0	4.7.4143.0
Microsoft .NET Framework 4.8 Product	>= 4.8.0, < 4.8.4803.0	4.8.4803.0
Microsoft .NET Framework 4.8.1 Product	>= 4.8.0.0, < 4.8.9340.0	4.8.9340.0
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Product	all versions	No fix yet
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Product	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-345, CWE-347

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Jul 14	Secret exfiltration vulnerability HighJul 14 CVE-2026-472821.128.1	High	1.128.1
Jul 14	Workspace Trust Security Feature Bypass Vulnerability HighJul 14 CVE-2026-571011.128.1	High	1.128.1
Jul 14	Remote Code Execution Vulnerability HighJul 14 CVE-2026-571021.128.1	High	1.128.1
Jul 14	Microsoft .NET 8.0: unsafe deserialization High7.8Jul 14 CVE-2026-506498.0.29+9 more	High7.8	8.0.29+9 more
Jul 14	Microsoft .NET 8.0: code injection High7.8Jul 14 CVE-2026-506508.0.29+10 more	High7.8	8.0.29+10 more
Jul 14	Microsoft .NET 10.0: resource exhaustion High7.5Jul 14 CVE-2026-5065110.0.10+5 more	High7.5	10.0.10+5 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.