Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-70035

.NET Framework Remote Code Execution Vulnerability

CVE-2026-70035: .NET Framework Remote Code Execution Vulnerability. Not in the CISA KEV catalog. High advisory severity (CVSS 8.8, MS Server).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-70035 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
8.8 (MS Server), 8.8 (Red Hat)
Weakness
CWE-502
Fixed releases
  • MS Server: KB5130036 (build 10.0.13), KB5130034 (build 8.0.32), KB5130035 (build 9.0.21), KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0) and 2 more in the advisory
  • Red Hat: dotnet8-0-main-8.0.132-0.1.hum1, RHSA-2026:84693
Vendor advisories
2 from MS Server, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-70035; bulletin-wide values are not repeated here.

Is CVE-2026-70035 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-70035 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-70035?

Upgrade to a fixed release named by the vendor:

  • MS Server: KB5130036 (build 10.0.13), KB5130034 (build 8.0.32), KB5130035 (build 9.0.21), KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0)
  • Red Hat: dotnet8-0-main-8.0.132-0.1.hum1, RHSA-2026:84693
  • Install the applicable security update for your platform: KB5130036, KB5130034, KB5130035, KB5127689, KB5127690, KB5127691 (see the Microsoft Update Catalog). (MS Server)

Vendor advisory comparison

MS Server

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-70035] .NET Framework Remote Code Execution Vulnerability

    CVE-2026-70035Source published

    .NET Framework Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.

    Affected products in this advisory
    • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
    • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
    • Microsoft .NET Framework 3.5 on Windows Server 2012 R2
    • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016

    3 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • KB5130036 (build 10.0.13)
    • KB5130034 (build 8.0.32)
    • KB5130035 (build 9.0.21)
    • KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)

    4 more entries in the full advisory.

    Mitigation guidance
    • Install the applicable security update for your platform: KB5130036, KB5130034, KB5130035, KB5127689, KB5127690, KB5127691 (see the Microsoft Update Catalog).
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-70035] arbitrary code execution via untrusted data deserialization

    CVE-2026-70035Source published Source updated

    arbitrary code execution via untrusted data deserialization. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. Red Hat lists fixing advisory RHSA-2026:84693 with package dotnet8-0-main-8.0.132-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • dotnet8-0-main-8.0.132-0.1.hum1
    • RHSA-2026:84693
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features