{"id":"CVE-2026-70035","published":"2026-10-13T19:19:14.490","lastModified":"2026-10-14T04:18:28.890","description":"Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70035","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This CVE describes a critical deserialization vulnerability in .NET Framework that allows remote code execution when untrusted data is processed. An attacker can exploit this to execute arbitrary code on a target system without authentication.","exploitability":"Exploitation is relatively straightforward with minimal preconditions, requiring only network access to a vulnerable .NET application that processes untrusted serialized data.","blast_radius":"The impact could be severe across many enterprise environments as .NET Framework is widely used for web applications and services, potentially leading to full system compromise.","remediation":"Upgrade to .NET Framework 4.8.1 or later, or apply the relevant security update from Microsoft.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","dotnet","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:54:55.828Z"}}