{"id":"CVE-2026-83520","published":"2026-10-13T19:19:57.933","lastModified":"2026-10-14T04:18:38.083","description":"Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83520","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A .NET deserialization vulnerability allows attackers to execute arbitrary code remotely by crafting malicious serialized data. This represents a critical security flaw because it can lead to complete system compromise without requiring authentication.","exploitability":"Exploitation is relatively straightforward with minimal preconditions, requiring only network access to the vulnerable .NET application that processes untrusted serialized data.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on affected systems, potentially leading to full system compromise and lateral movement across the network.","remediation":"Upgrade to .NET Framework 4.8.1 or later, or .NET Core 3.1.32 or later, or .NET 5.0.17 or later, or .NET 6.0.12 or later, or .NET 7.0.3 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","dotnet","remote"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:57:51.028Z"}}