Back
CVE-2026-32178
.NET Spoofing Vulnerability
High7.5EPSS 2.3%
- Published
- Updated
- Reserved
- Assigned by
- microsoft
Description
Improper neutralization of special elements in .NET allows an unauthorized attacker to perform spoofing over a network.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| microsoftCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
| redhat-SADPADP (enrichment) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 2.3% · top 17% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
- affected 10.0.0 – < 10.0.6
- affected 8.0 – < 8.0.26
- affected 8.0.0 – < 8.0.26
- affected 9.0.0 – < 9.0.15
Microsoft · Microsoft Visual Studio 2022 version 17.12
- affected 17.12.0 – < 17.12.19
Microsoft · Microsoft Visual Studio 2022 version 17.14
- affected 17.14.0 – < 17.14.30
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- NuGetMicrosoft.NetCore.App.Runtime.linux-armGHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.linux-arm64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.linux-musl-armGHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.linux-musl-arm64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.linux-musl-x64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.linux-x64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.osx-arm64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.osx-x64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.win-armGHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.win-arm64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.win-x64GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- NuGetMicrosoft.NetCore.App.Runtime.win-x86GHSA-vmwf-m9c5-3jvc (opens in a new tab)
References (21)
- .NET Spoofing Vulnerability (opens in a new tab)vendor-advisorypatch
- https://access.redhat.com/security/cve/CVE-2026-32178 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2457781 (opens in a new tab)issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32178.json (opens in a new tab)x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:13281 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13280 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8467 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8470 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8472 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8473 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8468 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8475 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13693 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13283 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13282 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8471 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8469 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8474 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9077 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9080 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9205 (opens in a new tab)vendor-advisoryx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-vmwf-m9c5-3jvc (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-32178)Record last updated .