Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-58280

.NET Denial of Service Vulnerability

CVE-2026-58280: .NET Denial of Service Vulnerability. Not in the CISA KEV catalog. High advisory severity (CVSS 7.5, MS Server).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-58280 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
7.5 (MS Server), 7.5 (Red Hat)
Weakness
CWE-776
Fixed releases
  • MS Server: KB5130035 (build 9.0.21), KB5130034 (build 8.0.32), KB5130036 (build 10.0.13), KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0) and 2 more in the advisory
  • Red Hat: dotnet10.0-0:10.0.113-1.el10_2, dotnet10.0-0:10.0.113-1.el9_8, dotnet9.0-0:9.0.122-1.el10_2, dotnet8.0-0:8.0.132-1.el10_2, dotnet8.0-0:8.0.132-2.el8_10, dotnet8-0-main-8.0.132-0.1.hum1 and 8 more in the advisory
Vendor advisories
2 from MS Server, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-58280; bulletin-wide values are not repeated here.

Is CVE-2026-58280 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-58280 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-58280?

Upgrade to a fixed release named by the vendor:

  • MS Server: KB5130035 (build 9.0.21), KB5130034 (build 8.0.32), KB5130036 (build 10.0.13), KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0)
  • Red Hat: dotnet10.0-0:10.0.113-1.el10_2, dotnet10.0-0:10.0.113-1.el9_8, dotnet9.0-0:9.0.122-1.el10_2, dotnet8.0-0:8.0.132-1.el10_2, dotnet8.0-0:8.0.132-2.el8_10, dotnet8-0-main-8.0.132-0.1.hum1
  • Install the applicable security update for your platform: KB5130035, KB5130034, KB5130036, KB5127689, KB5127690, KB5127691 (see the Microsoft Update Catalog). (MS Server)

Vendor advisory comparison

MS Server

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-58280] .NET Denial of Service Vulnerability

    CVE-2026-58280Source published

    .NET Denial of Service Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.

    Affected products in this advisory
    • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
    • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
    • Microsoft .NET Framework 3.5 on Windows Server 2012 R2
    • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016

    3 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • KB5130035 (build 9.0.21)
    • KB5130034 (build 8.0.32)
    • KB5130036 (build 10.0.13)
    • KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)

    4 more entries in the full advisory.

    Mitigation guidance
    • Install the applicable security update for your platform: KB5130035, KB5130034, KB5130036, KB5127689, KB5127690, KB5127691 (see the Microsoft Update Catalog).
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-58280] .NET Denial of Service Vulnerability

    CVE-2026-58280Source published Source updated

    .NET Denial of Service Vulnerability. Red Hat rates this important (CVSS 7.5). Weakness: CWE-776. Red Hat lists fixing advisory RHSA-2026:86594 with package dotnet10.0-0:10.0.113-1.el10_2, dotnet10.0-0:10.0.113-1.el9_8, dotnet9.0-0:9.0.122-1.el10_2, dotnet8.0-0:8.0.132-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.

    Related products — impact not confirmed
    • Red Hat Enterprise Linux 10
    • Red Hat Enterprise Linux 9
    • Red Hat Enterprise Linux 8
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • dotnet10.0-0:10.0.113-1.el10_2
    • dotnet10.0-0:10.0.113-1.el9_8
    • dotnet9.0-0:9.0.122-1.el10_2
    • dotnet8.0-0:8.0.132-1.el10_2

    10 more entries in the full advisory.

    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features