A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.
16 Oct 2026Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.
CVSS 3.1 base metricsRed raises the risk · green lowers it
Attack vector
NetworkAV:N
Attack complexity
HighAC:H
Privileges required
NonePR:N
User interaction
NoneUI:N
Scope
UnchangedS:U
Confidentiality
NoneC:N
Integrity
NoneI:N
Availability
HighA:H
Updates that fix it
0 KBs
No KB listed
No KB update is listed in the collected MSRC record. Check the MSRC advisory for product releases and other remedies.
Affected products
Developer Tools, Other
6 affected products
Microsoft Visual Studio 2022 version 17.14
Microsoft Visual Studio 2026 version 18.10
System.Security.Cryptography.Pkcs on .NET 10.0 runtime installed on Windows
System.Security.Cryptography.Pkcs on .NET 11.0 runtime installed on Windows
System.Security.Cryptography.Pkcs on .NET 8.0 runtime installed on Windows
System.Security.Cryptography.Pkcs on .NET 9.0 runtime installed on Windows
What changed
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → No (MSRC assessment) · Exploitation detected: Not reported by MSRC → No known exploitation (MSRC assessment)
Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed · CISA KEV: Unknown: catalog evidence is incomplete or retained → Not listed in the collected catalog
Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained · CISA KEV: Not listed in the collected catalog → Unknown: catalog evidence is incomplete or retained
Affected products: Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, System.Security.Cryptography.Pkcs on .NET 10.0 installed on Windows, System.Security.Cryptography.Pkcs on .NET 11.0 installed on Windows, System.Security.Cryptography.Pkcs on .NET 8.0 installed on Windows, System.Security.Cryptography.Pkcs on .NET 9.0 installed on Windows → Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, System.Security.Cryptography.Pkcs on .NET 10.0 runtime installed on Windows, System.Security.Cryptography.Pkcs on .NET 11.0 runtime installed on Windows, System.Security.Cryptography.Pkcs on .NET 8.0 runtime installed on Windows, System.Security.Cryptography.Pkcs on .NET 9.0 runtime installed on Windows
Publisher revision note: Updated the Security Updates table to add KB article links for .NET 11.0. This is an informational change only; the fixed builds are unchanged. → Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.
Publisher revision note: Information published. → Updated the Security Updates table to add KB article links for .NET 11.0. This is an informational change only; the fixed builds are unchanged.
Page history
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
22 Oct 2026 · 22:02:57 UTCAffected productsMicrosoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, System.Security.Cryptography.Pkcs on .NET 10.0 installed on Windows, System.Security.Cryptography.Pkcs on .NET 11.0 installed on Windows, System.Security.Cryptography.Pkcs on .NET 8.0 installed on Windows, System.Security.Cryptography.Pkcs on .NET 9.0 installed on Windows → Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.10, System.Security.Cryptography.Pkcs on .NET 10.0 runtime installed on Windows, System.Security.Cryptography.Pkcs on .NET 11.0 runtime installed on Windows, System.Security.Cryptography.Pkcs on .NET 8.0 runtime installed on Windows, System.Security.Cryptography.Pkcs on .NET 9.0 runtime installed on Windows
17 Oct 2026 · 07:28:24 UTCRevision noteUpdated the Security Updates table to add KB article links for .NET 11.0. This is an informational change only; the fixed builds are unchanged. → Updated the Security Updates table to add download and KB article links for Microsoft Visual Studio. This is an informational change only; the fixed builds are unchanged.
15 Oct 2026 · 21:30:54 UTCRevision noteInformation published. → Updated the Security Updates table to add KB article links for .NET 11.0. This is an informational change only; the fixed builds are unchanged.
CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.
CVE-2026-70162
No KEV entry is attached to this observation; this is not evidence that exploitation is absent.
FIRST EPSS: 0.89 % · percentile 59.73 % · scored 7 Nov 2026.
Risk history is separate from CNA/OSV content history. Daily score drift is retained but only an upward crossing of 10% triggers the prediction change event.
Each citation identifies one complete source statement. Source modification dates and the time this installation observed them are distinct. Latest history includes records historically associated by source identifiers; a removed alias is not a current equivalence claim. Exact citations show that source record's own earlier observations. Failed reads and unchanged polls do not rewrite history.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.
A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application.