CVE-2026-47304 is an improper verification of cryptographic signature flaw in .NET that lets an unauthorized attacker bypass a security feature over a network. The NVD record scores it CVSS 8.1 (high). It lists .NET, .NET Framework and several Visual Studio releases, so check Microsoft's guide for fixed versions.
What's affected
The NVD record lists these products as affected: Microsoft .NET, .NET Framework, Visual Studio 2017, 2019, 2022 and 2026, plus Apple macOS and the Linux kernel as platforms. Those last two reflect where .NET runs rather than separate flaws.
The record gives no version numbers. Microsoft's update guide entry is the only reference, and when I fetched it the page returned only template text, so I could not confirm the fixed builds. I will not state any here.
The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. High attack complexity is why the score stops at 8.1.
How to check if you're exposed
- List the runtimes and SDKs on a machine with
dotnet --list-runtimesanddotnet --list-sdks. - For container images, run
docker run --rm <image> dotnet --infoand read the runtime version. - For Visual Studio, open the Visual Studio Installer and note the installed version of each edition.
- For .NET Framework, check the installed version in the registry or through your inventory tool.
- Compare each result with the fixed versions in the Microsoft entry listed under Sources.
Projects pinned through global.json or a base image tag can sit on an old runtime even when the host is current, so check the pins too.
What to do now
- Read the Microsoft entry and note the fixed version for each .NET and Visual Studio line you run.
- Inventory runtimes and SDKs on build agents, servers and developer laptops.
- Update base images and rebuild containers that pin a runtime.
- Update Visual Studio through the installer on developer machines.
- Re-run your inventory afterward to confirm nothing is left behind.
Why it matters
The record maps this to CWE-345, insufficient verification of data authenticity, and CWE-347, improper verification of cryptographic signature. Signature checks are what let software trust that data came from the party it names. When a check can be bypassed, trust decisions built on it stop being reliable.
The record does not say which component or feature is affected, so avoid guessing at impact beyond a security feature bypass. Its KEV flag is false.
Quick check
Is CVE-2026-47304 exploited in the wild?
The record's KEV flag is false, and the pages I read do not say it is exploited. Treat it as a patch item and keep an eye on the advisory for changes.
Does this affect only .NET Framework?
No. The record lists .NET, .NET Framework and several Visual Studio versions. Read the Microsoft entry for the exact builds.
Sources
Last reviewed: 19 October 2026.
