The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-47302, CVE-2026-50525, CVE-2026-50651)

  - Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a     security feature over a network. (CVE-2026-47304)

  - Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny     service over a network. (CVE-2026-50524)

  - Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     perform tampering locally. (CVE-2026-50526)

  - Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a     network. (CVE-2026-50527)

  - Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a     network. (CVE-2026-50528)

  - Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.
    (CVE-2026-50646)

  - Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to     deny service over a network. (CVE-2026-50648)

  - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.
    (CVE-2026-50649)

  - Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized     attacker to elevate privileges locally. (CVE-2026-50650)

  - Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a     network. (CVE-2026-50659)

  - Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker     to deny service over a network. (CVE-2026-57108)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Security Update for Microsoft .NET Core (July 2026)

critical Nessus Plugin ID 326863

Version 1.5

Version 1.4

Version 1.2

Version 1.1

Version 1.5 Jul 27, 2026, 10:22 AM CVSS metrics ("CVSSv2 score" set to 10.0) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C") CVSS metrics ("CVSSv3 score" set to 9.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2026-50528" to "CVE-2026-47304") Plugin Feed: 202607271022
Version 1.4 Jul 18, 2026, 3:00 PM CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N") CVSSv3 score source (changed from "CVE-2026-50659" to none) CVSSv3 severity (based on None, severity increased from "Medium" to "High") Plugin metadata (Add IAVM Info) Plugin Feed: 202607181500
Version 1.2 Jul 15, 2026, 7:54 AM CVSS metrics ("CVSSv2 score" set to 8.5) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:P/I:C/A:N") CVSS metrics ("CVSSv3 score" set to 6.5) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N") CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:O/RC:C") CVSSv3 score source (set to "CVE-2026-50659") CVSSv3 severity (based on CVE-2026-50659, severity decreased from "High" to "Medium") Exploit attributes ("Exploit available" set to "False") Exploit attributes ("Exploitability ease" set to "No known exploits are available") Plugin Feed: 202607150754
Version 1.1 Jul 15, 2026, 2:58 AM New Plugin Feed: 202607150258