CVE-2026-108398 – .NET Framework Security Feature Bypass Vulnerability

CVE-2026-108398 is an Important security feature bypass vulnerability affecting Microsoft .NET Framework. The vulnerability allows an authenticated attacker with low-level privileges to bypass Windows Defender Application Control (WDAC) protections by exploiting an untrusted search path. An attacker could place a specially crafted .NET assembly on an affected system and register it for loading by a protected process, potentially allowing unauthorized code execution. With a CVSS score of 8.8, low attack complexity, and no user interaction required, this vulnerability presents a significant security risk. Microsoft has confirmed that the vulnerability is publicly disclosed, although active exploitation has not been reported.

CVSS SCORE: 8.8

SEVERITY: Important

Threat

This vulnerability threatens the effectiveness of Windows Defender Application Control (WDAC), a security mechanism designed to prevent unauthorized applications from running.

An attacker who already has low-level access to a vulnerable system could exploit this weakness to bypass application execution restrictions.

The primary security concerns include:

• Security Control Bypass: Attackers could circumvent WDAC restrictions and execute applications that would otherwise be blocked.
• Unauthorized Code Execution: Malicious code could execute within a protected process.
• Compromised System Integrity: Attackers could undermine application security policies and weaken endpoint protection.
• Potential Business Disruption: Successful exploitation could expose sensitive information, compromise system integrity, or affect service availability.

The vulnerability has a CVSS score of 8.8, reflecting its potentially serious impact on confidentiality, integrity, and availability.

Exploits

CVE-2026-108398 has been publicly disclosed, increasing the possibility that attackers may develop techniques to exploit the weakness.

Microsoft’s exploitability assessment indicates:

• Publicly Disclosed: Yes
• Actively Exploited: No
• Exploitation Assessment: Exploitation More Likely
• Exploit Code Maturity: Unproven

There is no confirmed evidence of active exploitation or publicly available proof-of-concept (PoC) exploit code.

However, Microsoft’s assessment that exploitation is more likely suggests attackers may be able to develop practical exploitation methods.

Because successful exploitation requires only low-level privileges and no user interaction, organizations should consider this vulnerability a significant security concern.

Technical Summary

CVE-2026-108398 is caused by an untrusted search path weakness (CWE-426) in Microsoft .NET Framework.

The vulnerability affects how .NET assemblies can be located and loaded within certain protected processes.

Under normal circumstances, Windows Defender Application Control (WDAC) enforces application execution policies that prevent unauthorized software from running.

However, this vulnerability creates an opportunity for an authenticated attacker to bypass those restrictions.

An attacker could exploit the vulnerability through the following sequence:

1. Gain authenticated access to an affected Windows system with low-level privileges.

2. Place a specially crafted .NET assembly on the vulnerable system.

3. Register the assembly so that it can be loaded by a protected process.

4. Trigger the loading of the malicious assembly.

5. Bypass WDAC enforcement and execute unauthorized code within the protected process.

The vulnerability has low attack complexity, meaning exploitation does not require unusually difficult conditions.

Additionally, the attack requires no user interaction, allowing exploitation without requiring someone to open a malicious document, click a link, or approve an action.

The vulnerability also has a changed security scope, indicating that successful exploitation could affect security boundaries beyond the initially vulnerable component.

The potential consequences include significant impacts on confidentiality, integrity, and availability.

Exploitability

Microsoft has assessed this vulnerability as “Exploitation More Likely.”

The affected Microsoft products include:

• Windows 10 version 21H2: Microsoft .NET Framework 3.5 and 4.8.1
• Windows Server 2022: Microsoft .NET Framework 3.5 and 4.8.1
• Windows Server 2025: Microsoft .NET Framework 3.5 and 4.8.1
• Windows 11 version 26H1: Microsoft .NET Framework 4.8.1

Successful exploitation requires an authenticated attacker with low privileges and local access to the affected system.

The attacker could exploit an untrusted assembly loading path to bypass WDAC restrictions and execute unauthorized code.

No user interaction is required.

Although active exploitation has not been confirmed, the vulnerability’s low attack complexity increases the potential for future exploitation.

Business Impact

CVE-2026-108398 creates a significant security concern for organizations relying on Windows Defender Application Control to restrict unauthorized applications.

“When attackers can bypass application controls, trusted systems can become a gateway for unauthorized code execution.”

The potential business consequences include:

• Weakened Endpoint Security: Attackers could bypass application control policies, reducing the effectiveness of endpoint security protections.
• Unauthorized Application Execution: Malicious or unapproved applications could execute within protected processes.
• Sensitive Data Exposure: Successful exploitation could potentially compromise confidential business information.
• System Integrity Risks: Attackers could undermine security restrictions designed to protect critical systems.
• Operational Disruption: Successful attacks could affect system availability and interrupt business operations.
• Compliance Concerns: Organizations relying on application control enforcement could face additional security and compliance risks if those controls are bypassed.

The vulnerability is particularly concerning for organizations that depend on strict application execution policies to protect business-critical environments.

Although exploitation requires existing authenticated access, successful exploitation could allow attackers to overcome an important security boundary.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

Organizations should prioritize deploying the appropriate security updates.

Relevant security updates include:

• Windows 10 version 21H2: KB5127689, KB5127690, KB5127692, KB5127694
• Windows Server 2022: KB5127693
• Windows Server 2025: KB5127690
• Windows 11 version 26H1: KB5127691

A system restart may be required after installing the updates.

If immediate patching is not possible, organizations should closely monitor affected systems for suspicious activity and unauthorized application execution.

These monitoring measures do not eliminate the underlying vulnerability.

Urgency

High-priority patch deployment is recommended because CVE-2026-108398 has been publicly disclosed and Microsoft considers exploitation more likely.

Although the vulnerability is rated Important rather than Critical, its CVSS score of 8.8 reflects the potentially severe consequences of successful exploitation.

Several factors increase the urgency:

• Public Disclosure: Technical awareness of the vulnerability could encourage attackers to develop exploitation methods.
• Low Attack Complexity: Exploitation does not require complex conditions.
• Minimal Privileges Required: An authenticated attacker needs only low-level privileges.
• No User Interaction: Exploitation does not require action from the victim.
• Security Control Bypass: Successful exploitation could undermine WDAC protections and enable unauthorized code execution.

Organizations should prioritize patching affected Windows endpoints and servers, particularly systems where WDAC is an important security control.

Early patch deployment can prevent a security control weakness from becoming an opportunity for attackers to execute unauthorized code.