Origin validation error in Microsoft products - CVE-2026-96238
Published: October 14, 2026
Vulnerability identifier: #VU155438
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96238
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass NuGet Package Source Mapping.
The vulnerability exists due to an origin validation error in NuGet Package Source Mapping in .NET when selecting packages from package sources. A remote attacker can cause content from an unauthorized package source to be selected and installed to bypass restrictions limiting packages to approved sources.
User interaction is required.
Affected software
.NET
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework
Visual Studio
.NET for Linux
.NET for macOS
Microsoft .NET Framework
How to mitigate CVE-2026-96238
Install security update from vendor's website.
.NET - addressed in versions 8.0.426, 9.0.122
Visual Studio - update to 17.14.42
.NET for Linux - addressed in versions 8.0.426, 9.0.122
.NET for macOS - addressed in versions 8.0.426, 9.0.122
Microsoft .NET Framework - update to 10.0.113
Visual Studio - update to 17.14.42
.NET for Linux - addressed in versions 8.0.426, 9.0.122
.NET for macOS - addressed in versions 8.0.426, 9.0.122
Microsoft .NET Framework - update to 10.0.113