EUVD-2026-99750Published

Active Directory Federation Services (AD FS) Spoofing Vulnerability

cve-program · CVE-2026-96222

Published

Microsoft .NET Framework 3.5

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 3.5",
                    "platforms": [
                        "Windows 11 version 26H1",
                        "Windows Server 2012",
                        "Windows Server 2012 R2"
                    ],
                    "versions": [
                        {
                            "version": "3.5.0",
                            "lessThan": "2.0.50727.9188 AND 3.0.30729.9171",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2",
                    "platforms": [
                        "Windows 10 version 1607",
                        "Windows Server 2016",
                        "Windows Server 2019"
                    ],
                    "versions": [
                        {
                            "version": "3.0.0.0",
                            "lessThan": "2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 3.5 AND 4.7.2

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 3.5 AND 4.7.2",
                    "platforms": [
                        "Windows 10 version 1809"
                    ],
                    "versions": [
                        {
                            "version": "4.7.0",
                            "lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 3.5 AND 4.8

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 3.5 AND 4.8",
                    "platforms": [
                        "Windows 10 version 1809",
                        "Windows 10 version 21H2",
                        "Windows 10 version 22H2",
                        "Windows Server 2019",
                        "Windows Server 2022"
                    ],
                    "versions": [
                        {
                            "version": "4.8.0",
                            "lessThan": "2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 3.5 AND 4.8.1

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 3.5 AND 4.8.1",
                    "platforms": [
                        "Windows 10 version 21H2",
                        "Windows 10 version 22H2",
                        "Windows 11 version 23H2",
                        "Windows 11 version 24H2",
                        "Windows 11 version 25H2",
                        "Windows 11 version 26H2",
                        "Windows Server 2022",
                        "Windows Server 2025"
                    ],
                    "versions": [
                        {
                            "version": "4.8.1",
                            "lessThan": "2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2",
                    "platforms": [
                        "Windows Server 2012",
                        "Windows Server 2012 R2"
                    ],
                    "versions": [
                        {
                            "version": "4.7.0",
                            "lessThan": "4.7.4150.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 4.8

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 4.8",
                    "platforms": [
                        "Windows 10 version 1607",
                        "Windows Server 2012",
                        "Windows Server 2012 R2",
                        "Windows Server 2016"
                    ],
                    "versions": [
                        {
                            "version": "4.8.0",
                            "lessThan": "4.8.4811.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft .NET Framework 4.8.1

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft .NET Framework 4.8.1",
                    "platforms": [
                        "Windows 11 version 26H1"
                    ],
                    "versions": [
                        {
                            "version": "4.8.0.0",
                            "lessThan": "4.8.9363.0",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft Visual Studio 2022 version 17.14

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft Visual Studio 2022 version 17.14",
                    "versions": [
                        {
                            "version": "17.14.0",
                            "lessThan": "17.14.42",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Microsoft Visual Studio 2026 version 18.10

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Microsoft Visual Studio 2026 version 18.10",
                    "versions": [
                        {
                            "version": "18.10.0",
                            "lessThan": "18.10.4",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

System.Security.Cryptography.Xml

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "System.Security.Cryptography.Xml",
                    "platforms": [
                        ".NET 8.0 runtime installed on Linux",
                        ".NET 8.0 runtime installed on Mac OS",
                        ".NET 8.0 runtime installed on Windows"
                    ],
                    "versions": [
                        {
                            "version": "10.0.0",
                            "lessThan": "8.0.5",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows 10 Version 1607

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows 10 Version 1607",
                    "platforms": [
                        "32-bit Systems",
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.14393.0",
                            "lessThan": "10.0.14393.9612",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows 10 Version 1809

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows 10 Version 1809",
                    "platforms": [
                        "32-bit Systems",
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.17763.0",
                            "lessThan": "10.0.17763.9376",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2012 R2

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2012 R2",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "6.3.9600.0",
                            "lessThan": "6.3.9600.23470",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2012 R2 (Server Core installation)

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2012 R2 (Server Core installation)",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "6.3.9600.0",
                            "lessThan": "6.3.9600.23470",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2016

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2016",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.14393.0",
                            "lessThan": "10.0.14393.9612",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2016 (Server Core installation)

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2016 (Server Core installation)",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.14393.0",
                            "lessThan": "10.0.14393.9612",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2019

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2019",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.17763.0",
                            "lessThan": "10.0.17763.9376",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2019 (Server Core installation)

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2019 (Server Core installation)",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.17763.0",
                            "lessThan": "10.0.17763.9376",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2022

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2022",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.20348.0",
                            "lessThan": "10.0.20348.5761",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2025

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2025",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.26100.0",
                            "lessThan": "10.0.26100.33650",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Windows Server 2025 (Server Core installation)

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "Microsoft",
                    "product": "Windows Server 2025 (Server Core installation)",
                    "platforms": [
                        "x64-based Systems"
                    ],
                    "versions": [
                        {
                            "version": "10.0.26100.0",
                            "lessThan": "10.0.26100.33650",
                            "versionType": "custom",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-99750

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Oct 13, 2026, 7:00:31 PM

dateUpdated: Oct 31, 2026, 6:06:49 PM

7 related source bulletins · separate from aliases

WID-SEC-W-2026-3893: Microsoft Entwicklerwerkzeuge: Mehrere Schwachstellen

CVE-2026-100205 · CVE-2026-102229 · CVE-2026-102231 · CVE-2026-102232 · CVE-2026-102233 · CVE-2026-102234 · CVE-2026-102235 · CVE-2026-102238 · CVE-2026-102851 · CVE-2026-102869 · CVE-2026-102870 · CVE-2026-103572 · CVE-2026-105016 · CVE-2026-105729 · CVE-2026-105732 · CVE-2026-108398 · CVE-2026-109468 · CVE-2026-58280 · CVE-2026-66822 · CVE-2026-69370 · CVE-2026-69651 · CVE-2026-70007 · CVE-2026-70035 · CVE-2026-70098 · CVE-2026-70159 · CVE-2026-70161 · CVE-2026-70162 · CVE-2026-70165 · CVE-2026-70174 · CVE-2026-70175 · CVE-2026-70179 · CVE-2026-70181 · CVE-2026-70183 · CVE-2026-70186 · CVE-2026-70188 · CVE-2026-70190 · CVE-2026-70194 · CVE-2026-70196 · CVE-2026-70197 · CVE-2026-83520 · CVE-2026-84008 · CVE-2026-85363 · CVE-2026-85790 · CVE-2026-87697 · CVE-2026-88092 · CVE-2026-92707 · CVE-2026-96222 · CVE-2026-96224 · CVE-2026-96225 · CVE-2026-96229 · CVE-2026-96230 · CVE-2026-96231 · CVE-2026-96232 · CVE-2026-96233 · CVE-2026-96234 · CVE-2026-96235 · CVE-2026-96236 · CVE-2026-96237 · CVE-2026-96238 · CVE-2026-96251 · CVE-2026-96303 · CVE-2026-96957 · CVE-2026-96958 · CVE-2026-96959 · CVE-2026-96960 · CVE-2026-97788 · CVE-2026-97801

RHSA-2026:86594: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

CVE-2026-58280 · CVE-2026-66822 · CVE-2026-69651 · CVE-2026-70159 · CVE-2026-70175 · CVE-2026-70179 · CVE-2026-70181 · CVE-2026-70183 · CVE-2026-70186 · CVE-2026-70188 · CVE-2026-70196 · CVE-2026-84008 · CVE-2026-88092 · CVE-2026-92707 · CVE-2026-96222 · CVE-2026-96225 · CVE-2026-96230 · CVE-2026-96231 · CVE-2026-96233 · CVE-2026-96236 · CVE-2026-96237 · CVE-2026-96238 · CVE-2026-96958 · CVE-2026-96959 · CVE-2026-96960

RHSA-2026:86169: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

RHSA-2026:88474: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-58280 · CVE-2026-58649 · CVE-2026-66822 · CVE-2026-69651 · CVE-2026-70159 · CVE-2026-70175 · CVE-2026-70179 · CVE-2026-70181 · CVE-2026-70183 · CVE-2026-70186 · CVE-2026-70188 · CVE-2026-70196 · CVE-2026-84008 · CVE-2026-88092 · CVE-2026-92707 · CVE-2026-96222 · CVE-2026-96225 · CVE-2026-96230 · CVE-2026-96231 · CVE-2026-96233 · CVE-2026-96236 · CVE-2026-96237 · CVE-2026-96238 · CVE-2026-96958 · CVE-2026-96959 · CVE-2026-96960

RHSA-2026:88425: Red Hat Security Advisory: .NET 8.0 security update

RHSA-2026:86168: Red Hat Security Advisory: .NET 8.0 security, bug fix, and enhancement update

RHSA-2026:88422: Red Hat Security Advisory: .NET 8.0 security update

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-96222

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-295

Original publisher date fields

published: 2026-10-13T19:21:48.030

lastModified: 2026-10-22T22:19:55.133

38 source CPE criteria · context only

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:-:*:*
cpe:2.3:a:microsoft:visual_studio_2026:*:*:*:*:*:-:*:*
cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:x64:*
cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_25h2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_26h2:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_26h1:-:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-vrv5-2jg9-4mmr

Published

System.Security.Cryptography.Xml

NuGet

ECOSYSTEM · introduced 8.0.0 → fixed 8.0.5

5 explicitly affected versions

8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4

Original source record · Cite this exact observation · Complete original publisher JSON