CVE-2026-26127

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 2.27%
EPSS Percentile: 83.15%
CISA KEV: Not listed

Description

Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 11-Mar-2026 01:18
Last Modified: 17-Jun-2026 17:25
EPSS Date: 2026-11-08
CWE: CWE-125

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:N /
                            I:N /
                            A:H

CNA Products / Version Status

Microsoft · .NET 10.0 Source: CNA · [email protected]
Default status: unknown

10.0.0 ≤ version < 10.0.4 — affected (custom)
Microsoft · .NET 9.0 Source: CNA · [email protected]
Default status: unknown

9.0.0 ≤ version < 9.0.14 — affected (custom)
Microsoft · Microsoft.Bcl.Memory Source: CNA · [email protected]
Default status: unknown

10.0.0 ≤ version < 10.0.4 — affected (custom)
Microsoft · Microsoft.Bcl.Memory Source: CNA · [email protected]
Default status: unknown

9.0.0 ≤ version < 9.0.14 — affected (custom)

Affected Products / Versions

microsoft / .net Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 10.0.0 · before (exclusive) 10.0.4
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
microsoft / .net Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 9.0.0 · before (exclusive) 9.0.14
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
microsoft / bcl.memory Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 9.0.0 · before (exclusive) 9.0.14
cpe:2.3:a:microsoft:bcl.memory:*:*:*:*:*:*:*:*
microsoft / bcl.memory Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 10.0.0 · before (exclusive) 10.0.4
cpe:2.3:a:microsoft:bcl.memory:*:*:*:*:*:*:*:*

References

[email protected]

Last enrichment sync: 09-Nov-2026 14:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

for 84 new vulnerabilities in its May 2026 update, including two publicly disclosed zero-days (CVE-2026-26127 in .NET and CVE-2026-21262 in SQL Server), with eight rated Critical and 76 rated Important Microsoft Patches 84 Vulnerabilities in May 2026 Update, Including Two Publicly Disclosed Zero-Days
Two publicly disclosed zero-days are CVE-2026-21262 (SQL Server) and CVE-2026-26127 (.NET). Microsoft’s March 2026 Patch Tuesday Fixes 79 Vulnerabilities, Including Two Disclosed Zero-Days
Two publicly disclosed zero-days were patched: CVE-2026-21262 in SQL Server and CVE-2026-26127 in .NET. Microsoft’s March 2026 Patch Tuesday Fixes 79 Flaws, Including Two Publicly Disclosed Zero-Days
These include CVE-2026-26127, a denial-of-service (DoS) issue in .NET, and CVE-2026-21262, an elevation of privilege defect in SQL Server. Microsoft Patches 83 Vulnerabilities in March 2026 Update

CVE (14)

People (6)

MITRE ATT&CK (2)

Vendors (7)

Products (25)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.