External risk intelligence

.NET Cryptographic Signature Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47304

.NET is a core framework for diverse applications, from internal tools to public web services. While the vulnerability allows network-based exploitation, its presence depends on how individual applications utilize the framework. Public exposure is therefore determined by the specific deployment configuration rather than inherent to the framework itself.

Microsoft Net Framework

4.8.14.84.6.24.74.7.14.7.23.58.0.0 to before 8.0.299.0.0 to before 9.0.1810.0.0 to before 10.0.615.0 to 15.916.0 to 16.1117.12.0 to before 17.12.2217.14.0 to before 17.14....

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in .NET technology that could allow an unauthorized attacker to bypass security measures over a network. This issue stems from an improper verification of cryptographic signatures within the .NET framework. The potential for exploitation exists across various Microsoft products and services that utilize .NET, underscoring the need to assess the relevance and exposure within our specific technology environment.

Security feature bypass via signature flaw.
Matters due to broad .NET framework usage.
Confirm relevance and exposure for our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to a vulnerable .NET application. This could allow them to bypass security checks that rely on cryptographic signatures, potentially leading to unauthorized access or malicious actions. The exact impact depends on how the application uses the .NET framework's signature verification capabilities.

Requires network access to the target.
Triggers vulnerability via a crafted signature.
Bypasses security controls.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthorized attacker to bypass security features over a network by improperly verifying cryptographic signatures. This bypass could affect the integrity of data or operations within applications that rely on these signatures for security.

System data integrity.
Bypass security feature over network.
Compromise application trust.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for .NET applications, infrastructure, and security will need to coordinate on this critical vulnerability that allows for network-based security bypass. The first practical step involves identifying all instances of the affected .NET Framework and .NET, assessing their network reachability and business criticality, and locating the accountable application or service owner to plan remediation.

Identify affected .NET installations.
Verify network exposure and business impact.
Coordinate with application and platform owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the .NET framework?

.NET is a broad software development platform created by Microsoft used to build, run, and deploy a wide range of applications. It serves as the foundational architecture for everything from local desktop tools and enterprise backend services to public-facing web applications. Because so many different types of software rely on its built-in libraries for core functions—like managing data, communication, and security—it is a pervasive component across Windows environments and diverse server systems.

What does this CVE-2026-47304 vulnerability mean?

This vulnerability involves a flaw in how the software performs cryptographic signature verification, classified as CWE-345 and CWE-347. In plain English, these signatures act like a digital seal to prove that data or code is authentic and has not been tampered with. Because the system fails to verify these seals correctly, an attacker can trick the application into trusting data that should have been rejected, effectively bypassing the security controls meant to protect the system.

How is CVE-2026-47304 triggered?

An attacker triggers this flaw by sending a specially crafted network request to a vulnerable application. The system then fails to properly check the cryptographic signature associated with that request. It is important to note that the vulnerability is not triggered by standard, legitimate application usage; it requires the successful transmission of the malicious, malformed signature that the system is unable to validate correctly.

Who should care about this CVE?

Anyone managing systems that run the affected .NET versions should care, as Halo Surface Signal notes that this is a critical, network-exploitable flaw. While your specific risk depends on how your unique applications utilize these cryptographic features, any service reachable over a network is a potential candidate for exploitation. Because .NET is so widely used in both internal and public-facing environments, you should prioritize identifying where these services reside in your network.

What are the first steps to address this?

Begin by creating an inventory of all systems in your environment that run the affected .NET versions. Once you have a list of these assets, coordinate with the respective application owners to assess which systems are reachable over the network and determine their business criticality. This initial discovery phase is essential for prioritizing which applications need immediate attention and planning the deployment of necessary updates to mitigate the risk.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47304

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.