Not Failing Securely ('Failing Open') in .NET - CVE-2026-118746

Vulnerability identifier: #VU165844

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-118746

CWE-ID: CWE-636

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication through impersonation and read or modify network communications.

The vulnerability exists due to failure to fail securely in the .NET authentication feature when handling network communications associated with a victim's request. A remote attacker can position themselves in the logical network path between the target and the resource requested by the victim to bypass authentication through impersonation and read or modify network communications.

.NET
Ubuntu
aspnetcore-runtime-10.0 (Ubuntu package)
dotnet-runtime-10.0 (Ubuntu package)
dotnet-hostfxr-10.0 (Ubuntu package)
dotnet-host-10.0 (Ubuntu package)
dotnet10 (Ubuntu package)
dotnet-sdk-aot-10.0 (Ubuntu package)
dotnet-sdk-10.0 (Ubuntu package)
aspnetcore-runtime-11.0 (Ubuntu package)
dotnet-host-11.0 (Ubuntu package)
dotnet-hostfxr-11.0 (Ubuntu package)
dotnet-runtime-11.0 (Ubuntu package)
dotnet-sdk-11.0 (Ubuntu package)
dotnet-sdk-aot-11.0 (Ubuntu package)
dotnet11 (Ubuntu package)

Install security update from vendor's website.

.NET - update to 11.0.0
aspnetcore-runtime-10.0 (Ubuntu package) - update to 10.0.15-0ubuntu1~26.10.1
dotnet-runtime-10.0 (Ubuntu package) - update to 10.0.15-0ubuntu1~26.10.1
dotnet-hostfxr-10.0 (Ubuntu package) - update to 10.0.15-0ubuntu1~26.10.1
dotnet-host-10.0 (Ubuntu package) - update to 10.0.15-0ubuntu1~26.10.1
dotnet10 (Ubuntu package) - update to 10.0.115-10.0.15-0ubuntu1~26.10.1
dotnet-sdk-aot-10.0 (Ubuntu package) - update to 10.0.115-0ubuntu1~26.10.1
dotnet-sdk-10.0 (Ubuntu package) - update to 10.0.115-0ubuntu1~26.10.1
aspnetcore-runtime-11.0 (Ubuntu package) - update to 11.0.0-0ubuntu1~26.10.1
dotnet-host-11.0 (Ubuntu package) - update to 11.0.0-0ubuntu1~26.10.1
dotnet-hostfxr-11.0 (Ubuntu package) - update to 11.0.0-0ubuntu1~26.10.1
dotnet-runtime-11.0 (Ubuntu package) - update to 11.0.0-0ubuntu1~26.10.1
dotnet-sdk-11.0 (Ubuntu package) - update to 11.0.100-0ubuntu1~26.10.1
dotnet-sdk-aot-11.0 (Ubuntu package) - update to 11.0.100-0ubuntu1~26.10.1
dotnet11 (Ubuntu package) - update to 11.0.100-11.0.0-0ubuntu1~26.10.1

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-118746
• https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md

• Multiple vulnerabilities in .NET
• Ubuntu update for dotnet10, dotnet11, dotnet8