Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-96233

ASP.NET Core Denial of Service Vulnerability

CVE-2026-96233: ASP.NET Core Denial of Service Vulnerability. Not in the CISA KEV catalog. High advisory severity (CVSS 7.5, MS Server).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-96233 at a glance

CISA KEV: Not listed (catalog checked Oct 22, 2026)
Highest advisory severity: High
CVSS base score: 7.5 (MS Server), 7.5 (Red Hat)
Weakness: CWE-125
Fixed releases: MS Server: KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0), KB5127692 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127693 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127694 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0) and 2 more in the advisory
Red Hat: dotnet10.0-0:10.0.113-1.el10_2, dotnet10.0-0:10.0.113-1.el8_10, dotnet10-0-main-10.0.113-1.hum1, dotnet10.0-0:10.0.113-1.el9_8, dotnet9-0-main-9.0.122-0.1.hum1, dotnet9.0-0:9.0.122-1.el10_2 and 7 more in the advisory
Vendor advisories: 2 from MS Server, Red Hat
VulniPulse record: Published Oct 14, 2026 · Updated Oct 21, 2026

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-96233; bulletin-wide values are not repeated here.

Is CVE-2026-96233 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-96233 is not in the CISA KEV catalog (checked Oct 22, 2026) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-96233?

Upgrade to a fixed release named by the vendor:

MS Server: KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127691 (build 4.8.9363.0), KB5127692 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127693 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0), KB5127694 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.10008.0)
Red Hat: dotnet10.0-0:10.0.113-1.el10_2, dotnet10.0-0:10.0.113-1.el8_10, dotnet10-0-main-10.0.113-1.hum1, dotnet10.0-0:10.0.113-1.el9_8, dotnet9-0-main-9.0.122-0.1.hum1, dotnet9.0-0:9.0.122-1.el10_2

Install the applicable security update for your platform: KB5127689, KB5127690, KB5127691, KB5127692, KB5127693, KB5127694 (see the Microsoft Update Catalog). (MS Server)

Vendor advisory comparison

MS Server

1 advisory

Advisory severityHigh7.5
High [CVE-2026-96233] ASP.NET Core Denial of Service Vulnerability
CVE-2026-96233Source published Oct 13, 2026
ASP.NET Core Denial of Service Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
Affected products in this advisory
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025
Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
3 more entries in the full advisory.
Source-reported affected versions
Affected-version details not available in this record.
Source-reported fixed versions
KB5127689 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)
KB5127690 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)
KB5127691 (build 4.8.9363.0)
KB5127692 (build 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0)
4 more entries in the full advisory.
Mitigation guidance
Install the applicable security update for your platform: KB5127689, KB5127690, KB5127691, KB5127692, KB5127693, KB5127694 (see the Microsoft Update Catalog).
Full advisory and evidence Open source bulletin

Red Hat

1 advisory

Advisory severityHigh7.5
High [CVE-2026-96233] ASP.NET Core Denial of Service Vulnerability
CVE-2026-96233Source published Oct 14, 2026Source updated Oct 14, 2026
ASP.NET Core Denial of Service Vulnerability. Red Hat rates this important (CVSS 7.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:86594 with package dotnet10.0-0:10.0.113-1.el10_2, dotnet10.0-0:10.0.113-1.el8_10, dotnet10-0-main-10.0.113-1.hum1, dotnet10.0-0:10.0.113-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Related products — impact not confirmed
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Source-reported affected versions
Affected-version details not available in this record.
Source-reported fixed versions
dotnet10.0-0:10.0.113-1.el10_2
dotnet10.0-0:10.0.113-1.el8_10
dotnet10-0-main-10.0.113-1.hum1
dotnet10.0-0:10.0.113-1.el9_8
9 more entries in the full advisory.
Mitigation guidance
No mitigation guidance extracted; consult the source.
Full advisory and evidence Open source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features