Improper Verification of Cryptographic Signature in Visual Studio and Microsoft .NET Framework - CVE-2026-96957
Published: October 14, 2026
Vulnerability identifier: #VU155541
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-96957
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass required NuGet package signature verification and execute untrusted package content.
The vulnerability exists due to improper verification of cryptographic signatures in .NET NuGet package signature verification when processing packages on affected Linux systems. A remote attacker can provide a specially crafted application that references an unsigned NuGet package to bypass required NuGet package signature verification and execute untrusted package content.
Exploitation requires a user to restore or run the application.
Affected software
Visual Studio
Microsoft .NET Framework
Microsoft .NET Framework
How to mitigate CVE-2026-96957
Install security update from vendor's website.
Visual Studio - update to 17.14.42
Microsoft .NET Framework - update to 10.0.402
Microsoft .NET Framework - update to 10.0.402