Detections
Analytics
Security Update for Microsoft .NET Core SDK (September 2026)
high Nessus Plugin ID 344806
Synopsis
The Microsoft .NET Core SDK installations on the remote host are affected by multiple vulnerabilities.Description
The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.- Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. (CVE-2026-69439)
- Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. (CVE-2026-69522, CVE-2026-71328)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update .NET Core, remove vulnerable packages and refer to vendor advisory.See Also
https://dotnet.microsoft.com/download/dotnet/10.0
https://dotnet.microsoft.com/download/dotnet/8.0
https://dotnet.microsoft.com/download/dotnet/9.0
https://github.com/dotnet/announcements/issues/438
https://github.com/dotnet/announcements/issues/439
https://github.com/dotnet/announcements/issues/440
https://support.microsoft.com/help/5126104
https://support.microsoft.com/help/5126105
https://support.microsoft.com/help/5126106
http://www.nessus.org/u?23c12104
Plugin Details
Severity: High
ID: 344806
File Name: smb_nt_ms26_sep_dotnet_core_sdk.nasl
Version: 1.1
Type: Local
Agent: windows
Family: Windows
Published: 9/11/2026
Updated: 9/11/2026
Configuration: Enable paranoid mode
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.15
CVSS v3
Risk Factor: High
Base Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:microsoft:.net_core
Required KB Items: Settings/ParanoidReport, installed_sw/.NET Core SDK Windows
Patch Publication Date: 9/8/2026
Vulnerability Publication Date: 9/8/2026