CVE-2026-70162

Awaiting Analysis Awaiting Analysis - Queue

Denial of Service in Microsoft .NET Web Application

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-70162

EUVD

EUVD-2026-100402

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	Visual Studio 2022 version 17.14 17.14.0
Microsoft	Microsoft	Visual Studio 2026 version 18.10 18.10.0
Microsoft	System.Security.Cryptography.Pkcs	10.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-405	The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in Microsoft's Common Object Runtime Library. It occurs when the library mishandles web requests, allowing a remote unauthenticated attacker to crash a .NET web application by sending specially crafted requests.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual web request patterns or application crashes in .NET applications. Check for excessive CPU or memory usage in .NET processes. Review server logs for malformed requests or repeated failed connections. Use network monitoring tools to identify spikes in traffic targeting .NET endpoints.

Impact Analysis

If exploited, this vulnerability could cause your .NET web application to become unavailable, disrupting services for legitimate users. It requires no authentication, making it easier for attackers to target systems.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial of service attacks against .NET web applications, potentially disrupting services that handle personal or health data. Downtime may lead to violations of availability requirements under these regulations.

Mitigation Strategies

Apply the latest security update from Microsoft to correct how the .NET web application handles web requests. This update addresses the vulnerability by fixing the improper handling of crafted requests.

Hi! I’m here to help you understand CVE-2026-70162. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70