CVE-2026-108398

CVE Enrichment

CVSS: 8.8 HIGH
CISA KEV: Not listed

Description

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 14-Oct-2026 02:18
Last Modified: 14-Oct-2026 06:17
CWE: CWE-426

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

secure@microsoft.com

Last enrichment sync: 14-Oct-2026 08:06
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (6)

One of them is CVE-2026-108398, which allows an attacker to bypass Windows Defender Application Control (WDAC) enforcement. Microsoft Fixes Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
CVE-2026-108398 has been acknowledged as publicly known at the time of the release of the patches, with Microsoft stating the security flaw could be exploited to bypass Windows Defender Application Control (WDAC) Microsoft Patches 1,413 Vulnerabilities, Including Actively Exploited Windows Shell Flaw
there are no signs anyone is exploiting it yet, a security feature bypass in the .NET Framework (CVE-2026-108398) was publicly disclosed prior to today, potentially giving attackers advance time to work out how to Microsoft Patches More Than 1,400 Security Flaws, Including an Exploited Zero-Day
CVE-2026-108398 - .NET Framework Security Feature Bypass Vulnerability Microsoft October 2026 Updates Fix 1,411 Flaws, Including Three Zero-Days
Both of the zero-days are potentially scary security bypasses. CVE-2026-96951 (CVSS 8.8) is the one under active exploit, found in Windows Shell. The other is CVE-2026-108398, found in .NET Framework Security. Microsoft’s October 2026 Patch Tuesday Fixes 1,413 CVEs, Including Two Zero-Days

CVE (1237)

People (13)

MITRE ATT&CK (2)

Vendors (14)

Products (113)

Tools (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.