Like a building where every badge opens every door because the lock reads your name but never checks your clearance level
Tenable plugin 341336 rolls up six CVEs patched in the August 2026 .NET Framework cumulative update. The headline flaw is CVE-2026-62872 (CVSS 8.8), an incorrect-authorization bug (CWE-863) that lets any authenticated low-privilege user escalate to higher roles over the network — no user interaction, low attack complexity. Alongside it sit CVE-2026-65810 (7.8), a local path-traversal elevation of privilege; CVE-2026-70354 (7.8), a WPF out-of-bounds write yielding local RCE when a victim opens a crafted document; CVE-2026-62886 (7.8), an elevation of privilege; CVE-2026-62897 (7.0), a secondary RCE; and CVE-2026-62902 (6.5), an information-disclosure issue. Affected .NET Framework versions span the entire supported range: 3.5, 4.6.2, 4.7–4.7.2, 4.8, and 4.8.1 — meaning every supported Windows machine running .NET Framework is in scope.
Tenable's VPR of 4.9 (Medium) dramatically undersells this bundle. While it correctly reflects the absence of exploitation activity and public proof-of-concept code, it fails to account for the sheer ubiquity of .NET Framework and the network-reachable, low-complexity attack vector of CVE-2026-62872. Microsoft's own 'Important' rating and CVSS 8.8 for the leading CVE are closer to reality. Any ASP.NET web application, ADFS federation service, or SharePoint deployment running unpatched .NET Framework is one authenticated request away from a privilege escalation. The VPR's temporal weighting is sound for triaging against actively-exploited zero-days, but for a fleet-wide patching decision on 10,000 Windows hosts, the 8.8 base score is the number that governs your exposure.
Bottom line: Under the noisgate mitigation SLA for a HIGH verdict, deploy compensating controls — network segmentation of .NET-based services, WAF enforcement, and MFA on all application portals — within 30 days. Target the actual cumulative update under the noisgate remediation SLA within 180 days. There is no active exploitation or KEV listing, so this is a methodical patch cycle, not a fire drill. Prioritize servers running ASP.NET services, ADFS, and SharePoint ahead of workstations. Note the known WPF printing regression (Calibri font FileFormatException) — resolved in the September 2026 update, so rolling straight to October 2026 CU avoids the side-effect entirely.
4 steps from start to impact.
Obtain low-privilege credentials
- Target host runs a .NET Framework application or service reachable over the network (IIS/ASP.NET, WCF, ADFS, SharePoint, SCCM console)
- Attacker possesses any valid low-privilege credential for that service
- Requires at least one valid credential — this is not a pre-auth attack
- MFA, conditional access, and credential hygiene raise the bar for initial credential acquisition
Send crafted request to trigger authorization bypass (CVE-2026-62872)
- Target .NET Framework is unpatched (versions 3.5 through 4.8.1 before the August 2026 cumulative update)
- The application uses .NET Framework's built-in authorization plumbing
- No public PoC — attacker must independently discover the trigger or wait for one to surface
- Microsoft rated exploitation 'Less Likely,' indicating the specific code path is non-trivial to reach
Escalate to higher-privilege application role
- Step 2 succeeded — the authorization check was bypassed
- Blast radius is bounded by the specific application's permission model and service account privileges
- Defense-in-depth (separate admin credentials, tiered access, gMSA accounts) may limit the elevated role's reach
Pivot or exfiltrate from the compromised service
- Elevated application privileges from Step 3
- The compromised service has access to sensitive data, secrets, or downstream systems
- Requires the compromised service to be high-value — workstation-tier apps have minimal pivot value
- Network segmentation between the app tier and data/identity tiers limits lateral movement
- DLP and CASB controls may flag bulk data exfiltration
System.IO.FileFormatException with Calibri fonts) — resolved in the September 2026 CU. Rolling straight to the October 2026 CU avoids the side-effect entirely. Under the noisgate remediation SLA for HIGH, deploy across the fleet within 180 days.- Antivirus / EDR signature scanning — CVE-2026-62872 is a logic flaw in the .NET Framework authorization layer, not malware. There is no shellcode, dropped binary, or file-based indicator for AV engines to match. EDR behavioral detection may catch post-exploitation lateral movement but cannot prevent the authorization bypass itself.
- Network IDS/IPS without TLS termination — the authorization bypass occurs within HTTPS application traffic. Passive network sensors inspecting encrypted flows see nothing actionable. A TLS-terminating WAF or reverse proxy is required for any visibility into the crafted request.
- Windows Defender Credential Guard — protects NTLM/Kerberos credential material in an isolated enclave but does not govern application-level authorization decisions within the .NET Framework runtime. The vulnerability is in the authZ logic, not the credential store.
- AppLocker / WDAC alone — application allowlisting controls which executables can run but cannot restrict what an already-running, legitimately signed .NET Framework host process (w3wp.exe, etc.) does with authorization checks internally. The malicious activity occurs within a trusted process.
The supporting signals.
| In-the-wild exploitation | None observed. Not listed in CISA KEV. Microsoft rates all six CVEs as *Exploitation Less Likely*. No campaigns, threat-actor usage, or honeypot hits documented as of 2026-10-20. |
|---|---|
| Proof-of-concept availability | No public PoC found. Checked pocindex.io, GitHub (no repos named after CVE-2026-62872, CVE-2026-70354, or CVE-2026-65810), ExploitDB, Nuclei templates, Metasploit modules, and the SecureWithUmer/CVE-2026-PoCs aggregator. No weaponized tooling or researcher write-ups with reproduction steps. |
| EPSS (30-day exploit probability) | CVE-2026-62872: 0.78% (55th percentile) · CVE-2026-65810: 0.40% (33rd percentile) · CVE-2026-70354: 0.36% (29th percentile). All below 1% — low predicted exploitation probability per FIRST EPSS API, data as of 2026-10-19. |
| CISA KEV status | Not listed. None of the six CVEs in this bundle appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-20. |
| CVSS vector (leading CVE) | CVE-2026-62872: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 HIGH. Network-reachable, low complexity, low privilege required, no user interaction, full CIA impact. Tenable temporal score: 6.8. Plugin CVSS v3 base: 7.8 (uses a different CVE as plugin baseline). VPR: 4.9 (Medium). |
| Affected versions | .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1 across all supported Windows client and server editions: Windows 10 1607+, Windows 11 23H2/24H2/25H2/26H1, Server 2012/2012R2/2016/2019/2022/2025. CVE-2026-70354 also affects .NET (Core) 8.0 < 8.0.30, 9.0 < 9.0.19, 10.0 < 10.0.11 (WPF runtime). |
| Fixed versions / KBs | 18+ KBs by OS variant: KB5120708 (Win11 25H2 / Server 2025), KB5120710 (Win11 24H2), KB5120713 (Win11 23H2), KB5120709 (Win10 22H2 4.8.1), KB5120701 (Win10 22H2 4.8), KB5120714 (Server 2022 4.8.1), KB5120705 (Server 2022 4.8), KB5120698 (Win10 1809 / Server 2019), KB5120702 (Server 2016 4.8), others. Full matrix: Microsoft release notes. September and October 2026 CUs supersede. |
| Scanning / exposure | No GreyNoise or Shodan scanning activity targeting these CVEs specifically. .NET Framework is not directly internet-exposed — exploitation requires reaching an ASP.NET app or .NET service behind IIS. Shodan/Censys IIS fingerprinting (http.component:asp.net) can estimate external ASP.NET surface area but the authorization flaw is equally relevant to internal-only services. |
| Disclosure date | 2026-08-11 (Microsoft Patch Tuesday). No prior public disclosure for any of the six CVEs. All were coordinated disclosure through MSRC. Plugin published 2026-08-28. |
| Reporting researcher | Not publicly attributed. Microsoft's advisories do not credit external researchers for any of the six CVEs. Likely discovered via internal code audit or MAPP partner reporting. |
Sources.
- Tenable Plugin 341336
- Microsoft .NET Framework August 2026 Cumulative Update Release Notes
- .NET and .NET Framework August 2026 Servicing Updates — .NET Blog
- Rapid7 Patch Tuesday August 2026 Review
- ZDI August 2026 Security Update Review
- CVE-2026-62872 Detail — Strix.ai
- CVE-2026-70354 WPF OOB Write Analysis — SecureLayer7
- FIRST EPSS Data — CVE-2026-62872 / 65810 / 70354
Why this verdict
- Leading CVE warrants HIGH on its own merits. CVE-2026-62872 scores CVSS 8.8 with a network attack vector, low complexity, and no user interaction. The only friction is the PR:L requirement (a valid low-privilege credential), which is already factored into the CVSS vector and does not warrant further downgrade — in most enterprises, any domain user account or web-app login qualifies.
- Ubiquitous installed base eliminates population narrowing. .NET Framework 3.5–4.8.1 ships with and is present on every supported Windows OS. Unlike a niche-appliance vulnerability where <1% of enterprises are affected, this touches 100% of Windows fleets. There is no 'we don't run this' escape hatch.
- Role multiplier: identity-tier and LOB-tier blast radius sets a HIGH floor. .NET Framework powers ASP.NET on IIS, ADFS federation services, SharePoint, SCCM web consoles, and thousands of internal LOB applications. On ADFS (identity tier), an authorization bypass leads to federation compromise — domain-scale blast radius. On SharePoint and LOB web apps (typical tier), it yields application-level admin access and data exfiltration. These high-value roles represent ≥10% of the .NET Framework installed base (every Windows server running IIS with ASP.NET), setting a verdict floor of HIGH.
- Downward pressure from exploitation landscape. No in-the-wild exploitation, no public PoC, EPSS < 1%, and Microsoft's 'Exploitation Less Likely' assessment all apply legitimate temporal friction. This prevents escalation to CRITICAL and justifies a reassessed score of 7.5 rather than the raw 8.8 base.
- VPR 4.9 is a material undercount. Tenable's VPR correctly weights temporal factors but over-discounts the base severity of a network-reachable, no-interaction auth bypass in the world's most ubiquitous managed runtime. A 4.9 Medium score risks deprioritizing this below workstation-class vulnerabilities that pose less organizational risk, which is a fleet-management error on a 10,000-host estate.
Why not higher?
CRITICAL requires either pre-authentication access, active exploitation, or a canonical high-value-role component where the majority of installs are definitionally in the blast zone (like a hypervisor or domain controller OS). CVE-2026-62872 requires authentication (PR:L), has no exploitation activity or PoC, and .NET Framework — while ubiquitous — is a runtime framework, not a role-defining service. The identity-tier impact (ADFS) is real but indirect: it depends on which application is built atop .NET Framework, and ADFS is a subset of the total .NET Framework deployed population. The EPSS of 0.78% and 'Exploitation Less Likely' assessment further confirm the current exploitability does not reach CRITICAL.
Why not lower?
MEDIUM is inappropriate because CVE-2026-62872 is network-reachable (AV:N), requires no user interaction (UI:N), has low attack complexity (AC:L), and grants full C:H/I:H/A:H impact. The .NET Framework installed base is 100% of Windows fleets — there is zero population narrowing. On high-value roles (ADFS, SharePoint, LOB web apps running on IIS), the chain completes to application-admin or domain-scale compromise with a single authenticated request. The verdict floor is HIGH per the deployment-role blast radius rule; no friction point is sufficient to break through that floor when the runtime is this pervasive.
Crowdsourced verification payload.
Run on each target Windows host with Administrator privileges. Save as Check-DotNetAug2026.ps1 and invoke: powershell -ExecutionPolicy Bypass -File .\Check-DotNetAug2026.ps1. The script confirms .NET Framework 4.x is present via the registry, then searches Get-HotFix and DISM package inventory for any of the 19 August 2026 cumulative-update KBs.
#Requires -RunAsAdministrator
<#
.SYNOPSIS
Verify August 2026 .NET Framework security update (Tenable 341336)
CVEs: CVE-2026-62872, CVE-2026-65810, CVE-2026-70354,
CVE-2026-62886, CVE-2026-62897, CVE-2026-62902
.OUTPUTS
PATCHED | VULNERABLE | UNKNOWN Exit: 0 | 1 | 2
#>
$ErrorActionPreference = 'SilentlyContinue'
# August 2026 .NET Framework cumulative update KBs (all OS variants)
$targetKBs = @(
'5120418','5120695','5120698','5120699','5120700','5120701',
'5120702','5120703','5120704','5120705','5120706','5120708',
'5120709','5120710','5120711','5120713','5120714','5120716','5120747'
)
# Step 1: confirm .NET Framework 4.x is present
$ndpPath = 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full'
$rel = (Get-ItemProperty -Path $ndpPath -ErrorAction SilentlyContinue).Release
if (-not $rel) {
Write-Host 'UNKNOWN - .NET Framework 4.x not detected on this host'
exit 2
}
$v = if ($rel -ge 533320) { '4.8.1' }
elseif ($rel -ge 528040) { '4.8' }
elseif ($rel -ge 461808) { '4.7.2' }
elseif ($rel -ge 461308) { '4.7.1' }
elseif ($rel -ge 460798) { '4.7' }
elseif ($rel -ge 394802) { '4.6.2' }
else { '<4.6.2'}
Write-Host "[*] .NET Framework $v detected (release key $rel)"
# Step 2: collect installed KBs from multiple sources
$allIds = @()
# Source A: Get-HotFix
try {
$allIds += (Get-HotFix).HotFixID -replace '^KB',''
} catch {}
# Source B: DISM package inventory (catches .NET patches missed by Get-HotFix)
try {
$dism = dism.exe /online /get-packages /format:table 2>$null
foreach ($kb in $targetKBs) {
if ($dism | Select-String -SimpleMatch $kb -Quiet) {
$allIds += $kb
}
}
} catch {}
# Source C: Windows Update COM history
try {
$sess = New-Object -ComObject Microsoft.Update.Session
$srch = $sess.CreateUpdateSearcher()
$total = $srch.GetTotalHistoryCount()
if ($total -gt 0) {
$hist = $srch.QueryHistory(0, [Math]::Min($total, 300))
foreach ($e in $hist) {
foreach ($kb in $targetKBs) {
if ($e.Title -match $kb) { $allIds += $kb }
}
}
}
} catch {}
$allIds = $allIds | Sort-Object -Unique
# Step 3: match against August 2026 KBs
foreach ($kb in $targetKBs) {
if ($allIds -contains $kb) {
Write-Host "PATCHED - KB$kb is installed (August 2026 .NET Framework cumulative update)"
exit 0
}
}
Write-Host 'VULNERABLE - No August 2026 .NET Framework security update found'
Write-Host 'Install the correct KB for your OS from:'
Write-Host ' https://learn.microsoft.com/dotnet/framework/release-notes/2026/08-11-august-cumulative-update'
exit 1