Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-83520

.NET Remote Code Execution Vulnerability

CVE-2026-83520: .NET Remote Code Execution Vulnerability. Not in the CISA KEV catalog. High advisory severity (CVSS 8.8, MS Server).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-83520 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
8.8 (MS Server)
Weakness
CWE-502
Fixed releases
  • MS Server: KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0), KB5127692 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127693 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127694 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0) and 2 more in the advisory
  • Red Hat: dotnet8-0-main-8.0.132-0.1.hum1, RHSA-2026:84693
Vendor advisories
2 from MS Server, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-83520; bulletin-wide values are not repeated here.

Is CVE-2026-83520 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-83520 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-83520?

Upgrade to a fixed release named by the vendor:

  • MS Server: KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0), KB5127692 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127693 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127694 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0)
  • Red Hat: dotnet8-0-main-8.0.132-0.1.hum1, RHSA-2026:84693
  • Install the applicable security update for your platform: KB5127689, KB5127690, KB5127691, KB5127692, KB5127693, KB5127694 (see the Microsoft Update Catalog). (MS Server)

Vendor advisory comparison

MS Server

1 advisory
  • Advisory severityHigh8.8

    High [CVE-2026-83520] .NET Remote Code Execution Vulnerability

    CVE-2026-83520Source published

    .NET Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.

    Affected products in this advisory
    • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
    • Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
    • Microsoft .NET Framework 3.5 on Windows Server 2012 R2
    • Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016

    3 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)
    • KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)
    • KB5127691 (build 4.8.9363.0)
    • KB5127692 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)

    4 more entries in the full advisory.

    Mitigation guidance
    • Install the applicable security update for your platform: KB5127689, KB5127690, KB5127691, KB5127692, KB5127693, KB5127694 (see the Microsoft Update Catalog).
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh

    High [CVE-2026-83520] Arbitrary code execution via untrusted data deserialization

    CVE-2026-83520Source published Source updated

    Arbitrary code execution via untrusted data deserialization. Red Hat rates this important. Weakness: CWE-502. Red Hat lists fixing advisory RHSA-2026:84693 with package dotnet8-0-main-8.0.132-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • dotnet8-0-main-8.0.132-0.1.hum1
    • RHSA-2026:84693
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features