CVE-2022-26929
published 2022-09-13CVE-2022-26929: .NET Framework Remote Code Execution Vulnerability
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
1.36%
68.5th percentile
.NET Framework Remote Code Execution Vulnerability
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_net_framework_3.5_and_4.6_4.6.2 | >= 10.0.0 < 10.0.10240.19444 | 10.0.10240.19444 |
| microsoft | microsoft_net_framework_3.5_and_4.8.1 | >= 4.8.1 < 3.5.09082.05 | 3.5.09082.05 |
| microsoft | microsoft_net_framework_4.8.1 | >= 4.8.0.0 < 4.8.04556.03 | 4.8.04556.03 |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| msrc | microsoft_net_framework_3.5_and_4.6_4.6.2_on_windows_10_for_32-bit_systems | — | — |
| msrc | microsoft_net_framework_3.5_and_4.6_4.6.2_on_windows_10_for_x64-based_systems | — | — |
| msrc | microsoft_net_framework_3.5_and_4.8.1_on_windows_11_version_21h2_for_arm64-base | — | — |
| msrc | microsoft_net_framework_3.5_and_4.8.1_on_windows_11_version_21h2_for_x64-based | — | — |
| msrc | microsoft_net_framework_3.5_and_4.8.1_on_windows_server_2022 | — | — |
| msrc | microsoft_net_framework_4.8.1_on_windows_10_version_21h1_for_32-bit_systems | — | — |
| msrc | microsoft_net_framework_4.8.1_on_windows_10_version_21h1_for_arm64-based_system | — | — |
| msrc | microsoft_net_framework_4.8.1_on_windows_10_version_21h1_for_x64-based_systems | — | — |
| msrc | microsoft_net_framework_4.8.1_on_windows_10_version_21h2_for_32-bit_systems | — | — |
| msrc | microsoft_net_framework_4.8.1_on_windows_10_version_21h2_for_arm64-based_system | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9g82-g79v-qfx9
ghsa_unreviewed·2022-09-14
CVE-2022-26929 [HIGH] GHSA-9g82-g79v-qfx9
.NET Framework Remote Code Execution Vulnerability.
Microsoft
.NET Framework Remote Code Execution Vulnerability
vendor_msrc·2022-09-13·CVSS 7.8
CVE-2022-26929 [HIGH] .NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.
For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.
FAQ: The Security Updates table indicates that this vulnerability affects all supported versions of .
Red Hat
dotnet: .NET Framework Remote Code Execution Vulnerability.
vendor_redhat·2022-09-13·CVSS 7.8
CVE-2022-26929 [HIGH] dotnet: .NET Framework Remote Code Execution Vulnerability.
dotnet: .NET Framework Remote Code Execution Vulnerability.
.NET Framework Remote Code Execution Vulnerability
A remote code execution vulnerability was found in dotnet. This flaw allows an attacker to perform arbitrary code execution, leading to a local attack on a user’s system.
Package: rh-dotnet60 (.NET 6.0 on Red Hat Enterprise Linux) - Not affected
Package: rh-dotnet31 (.NET Core 3.1 on Red Hat Enterprise Linux) - Not affected
Package: dotnet3.1 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet6.0 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet7.0 (Red Hat Enterprise Linux 8) - Not affected
Package: dotnet6.0 (Red Hat Enterprise Linux 9) - Not affected
Package: dotnet7.0 (Red Hat Enterprise Linux 9) - Not affected
No detection rules found.
No public exploits indexed.
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical.
## Table of Contents
Microsoft Patch Tuesday Summary
The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
Notable Microsoft Vulnerabilities Patched
Zero-Day Vulnerabilities Addressed
Microsoft Important Vulnerability Highlights
Microsoft Edge | Last But Not Least
Adobe Security Bulletins and Advisories
About Qualys Patch Tuesday
Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
Rapid Response With Patch Management (PM)
Evaluate Vendor-Suggested Workarounds With Policy Compliance
Qualys This Month in Vulnerabilities and Patches Webinar Series
Join the Webinar This Month in Vulnerabilities & Patches
NEW & NOTEWORTHY
Qualys
September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
blogs_qualys·2022-09-13·CVSS 5.6
[MEDIUM] September 2022 Patch Tuesday | Microsoft Releases 63 Vulnerabilities With 5 Critical, Plus 16 Microsoft Edge (Chromium-Based); Adobe Releases 7 Advisories, 63 Vulnerabilities With 35 Critical. | Qualy
#### Table of Contents
- Microsoft Patch Tuesday Summary
- The September 2022 Microsoft Vulnerabilities Are Classified As Follows:
- Notable Microsoft Vulnerabilities Patched
- Zero-Day Vulnerabilities Addressed
- Microsoft Important Vulnerability Highlights
- Microsoft Edge | Last But Not Least
- Adobe Security Bulletins and Advisories
- About Qualys Patch Tuesday
- Qualys Threat Protection High-Rated Advisories from August to September 2022 Patch Tuesday Advisory
- Discover and Prioritize Vulnerabilities in Vulnerability Management Detection Response (VMDR)
- Rapid Response With Patch Management (PM)
- Evaluate Vendor-Suggested Workarounds With Policy Compliance
- Qualys This Month in Vulnerabilities and Patches Webinar Series
- Join the Webinar This Month in Vulnerabilities & Patches
-
2022-09-13
Published