Permissive List of Allowed Inputs in Microsoft products - CVE-2026-96229
Published: October 14, 2026
Vulnerability identifier: #VU155429
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96229
CWE-ID: CWE-183
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a permissive list of allowed inputs in .NET when processing inputs over a network. A remote attacker can exploit the permissive input allowlist to disclose NetNTLMv2 hashes.
User interaction is required for exploitation.
Affected software
.NET
Visual Studio
Microsoft .NET Framework
Visual Studio
Microsoft .NET Framework
How to mitigate CVE-2026-96229
Install security update from vendor's website.
.NET - addressed in versions 8.0.32, 9.0.21
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.13
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.13