Security Update for Microsoft .NET Core SDK (October 2026)

critical Nessus Plugin ID 366547

Language:

Synopsis

The Microsoft .NET Core SDK installations on the remote host are affected by multiple vulnerabilities.

Description

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

- Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

- Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

- Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update .NET Core, remove vulnerable packages and refer to vendor advisory.

Plugin Details

Severity: Critical

ID: 366547

File Name: smb_nt_ms26_oct_dotnet_core_sdk.nasl

Version: 1.1

Type: Local

Agent: windows

Family: Windows

Published: 10/16/2026

Updated: 10/16/2026

Configuration: Enable paranoid mode

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.49

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:microsoft:.net_core

Required KB Items: Settings/ParanoidReport, installed_sw/.NET Core SDK Windows

Patch Publication Date: 10/13/2026

Vulnerability Publication Date: 10/13/2026

Reference Information

CVE: CVE-2026-102870, CVE-2026-105016, CVE-2026-58280, CVE-2026-66822, CVE-2026-69651, CVE-2026-70007, CVE-2026-70035, CVE-2026-70159, CVE-2026-70161, CVE-2026-70162, CVE-2026-70165, CVE-2026-70174, CVE-2026-70175, CVE-2026-70179, CVE-2026-70181, CVE-2026-70183, CVE-2026-70186, CVE-2026-70188, CVE-2026-70190, CVE-2026-70196, CVE-2026-70197, CVE-2026-83520, CVE-2026-84008, CVE-2026-85363, CVE-2026-85790, CVE-2026-87697, CVE-2026-88092, CVE-2026-92707, CVE-2026-96222, CVE-2026-96224, CVE-2026-96225, CVE-2026-96229, CVE-2026-96230, CVE-2026-96231, CVE-2026-96232, CVE-2026-96233, CVE-2026-96234, CVE-2026-96235, CVE-2026-96236, CVE-2026-96237, CVE-2026-96238, CVE-2026-96957, CVE-2026-96958, CVE-2026-96959, CVE-2026-96960

CWE: 122, 125, 1325, 183, 190, 201, 22, 290, 295, 346, 347, 358, 362, 405, 416, 444, 502, 59, 640, 674, 770, 787, 79, 829, 833, 94

IAVA: 2026-A-1124

Detections

Analytics