CVE-2026-96222
published 2026-10-13CVE-2026-96222: Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
PriorityP347high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.59%
47.8th percentile
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_net_framework_3.5 | >= 3.5.0 < 2.0.50727.9188 AND 3.0.30729.9171 | 2.0.50727.9188 AND 3.0.30729.9171 |
| microsoft | microsoft_net_framework_3.5_and_4.6.2_4.7_4.7.1_4.7.2 | >= 3.0.0.0 < 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 | 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 |
| microsoft | microsoft_net_framework_3.5_and_4.7.2 | >= 4.7.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0 |
| microsoft | microsoft_net_framework_3.5_and_4.8 | >= 4.8.0 < 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 | 2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0 |
| microsoft | microsoft_net_framework_3.5_and_4.8.1 | >= 4.8.1 < 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 | 2.0.50727.9188 AND 3.0.30729.9171 AND 4.8.9363.0 |
| microsoft | microsoft_net_framework_4.6.2_4.7_4.7.1_4.7.2 | >= 4.7.0 < 4.7.4150.0 | 4.7.4150.0 |
| microsoft | microsoft_net_framework_4.8 | >= 4.8.0 < 4.8.4811.0 | 4.8.4811.0 |
| microsoft | microsoft_net_framework_4.8.1 | >= 4.8.0.0 < 4.8.9363.0 | 4.8.9363.0 |
| microsoft | microsoft_visual_studio_2022_version_17.14 | >= 17.14.0 < 17.14.42 | 17.14.42 |
| microsoft | microsoft_visual_studio_2026_version_18.10 | >= 18.10.0 < 18.10.4 | 18.10.4 |
| microsoft | net | >= 8.0.0 < 8.0.5 | 8.0.5 |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
| microsoft | system.security.cryptography.xml | >= 10.0.0 < 8.0.5 | 8.0.5 |
| microsoft | system.security.cryptography.xml | >= 8.0.0 < 8.0.5 | 8.0.5 |
| microsoft | visual_studio_2022 | >= 17.14.0 < 17.14.42 | 17.14.42 |
| microsoft | visual_studio_2026 | >= 18.10.0 < 18.10.4 | 18.10.4 |
| microsoft | windows_10_1607 | < 10.0.14393.9612 | 10.0.14393.9612 |
| microsoft | windows_10_1809 | < 10.0.17763.9376 | 10.0.17763.9376 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.9612 | 10.0.14393.9612 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
ghsa7.4HIGH
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
.NET vulnerabilities
vendor_ubuntu·2026-10-20
CVE-2026-70188 .NET vulnerabilities
Title: .NET vulnerabilities
Summary: Several security issues were fixed in .NET.
Multiple security issues were discovered in .NET and this update includes
new upstream .NET versions to fix these issues.
.NET 8 has been updated to 8.0.32 in Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
.NET 10 has been updated to 10.0.13 in Ubuntu 24.04 LTS, Ubuntu 26.04 LTS
and Ubuntu 26.10. .NET 11 has been updated to 11.0.0~rc2 in Ubuntu 26.10.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability
vendor_redhat·2026-10-13·CVSS 7.4
CVE-2026-96222 [HIGH] CWE-295 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability
dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Package: dotnet8.0 (Red Hat Enterprise Linux 10) - Affected
Package: dotnet8.0 (Red Hat Enterprise Linux 8) - Affected
Package: dotnet8.0 (Red Hat Enterprise Linux 9) - Affected
Package: dotnet8.0 (Red Hat Hardened Images) - Affected
VulDB
Microsoft System.Security.Cryptography.Xml up to 8.0.4 KeyInfoX509Data certificate validation
vuldb·2026-10-14·CVSS 7.4
CVE-2026-96222 [HIGH] Microsoft System.Security.Cryptography.Xml up to 8.0.4 KeyInfoX509Data certificate validation
A vulnerability, which was classified as problematic, has been found in Microsoft System.Security.Cryptography.Xml up to 8.0.4. This affects an unknown function of the component KeyInfoX509Data. Performing a manipulation results in improper certificate validation.
This vulnerability is known as CVE-2026-96222. Remote exploitation of the attack is possible. No exploit is available.
It is advisable to upgrade the affected component.
GHSA
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
ghsa·2026-10-13·CVSS 7.4
CVE-2026-96222 [HIGH] CWE-295 Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability
## Executive summary
Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.
`KeyInfoX509Data` can accept serialized certificate formats containing attacker-controlled chain metadata instead of requiring a plain X.509 certificate, contributing to certificate-forgery and token-spoofing paths.
## Announcement
Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/474
## CVSS Details
- **Version:** 3.1
- **Severity:** High
- **Score:** 7.4
- **Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C
No detection rules found.
No public exploits indexed.
Sans Isc
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
blogs_sans_isc·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
October 2026 Microsoft Patch Tuesday
Published: 2026-10-13. Last Updated: 2026-10-13 19:25:52 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.
CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.
CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be
Qualys
Microsoft Patch Tuesday, October 2026 Security Update Review
blogs_qualys·2026-10-13
CVE-2026-96951 Microsoft Patch Tuesday, October 2026 Security Update Review
## Table of Contents
Adobe Patch for October 2026
Zero-day Vulnerabilities Patched in September Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in September Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withTruRisk Eliminate
Qualys Monthly Webinar Series
Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to reducing exposure and strengthening security posture. This month’s updates highlight the importance of identif
Rapid7
Patch Tuesday - October 2026
blogs_rapid7·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Patch Tuesday - October 2026
Microsoft is publishing 1,413 own-product vulnerabilities on October 2026 Patch Tuesday , including 1,102 vulnerabilities in Windows. Anyone who enjoyed last month’s record-setting Patch Tuesday will love the October 2026 edition, because it’s much bigger still. As Rapid7 has noted over the course of 2026, there is every reason to suppose that vulnerability volumes will continue to rise. Microsoft is aware of exploitation in the wild for just one of the vulnerabilities published today, as well as public disclosure for two others.
## Windows Shell: zero-day security feature bypass
The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs, and for the second time this year , the Windows Shell is the site
Talos
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
blogs_talos·2026-10-13·CVSS 9.8
CVE-2026-96951 [CRITICAL] Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild
CVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.
Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.
Microsoft considers exploitation of the following vulnerabilities more likely.
CVE-2026-7
Crowdstrike
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
blogs_crowdstrike
CVE-2026-100219 October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance Oct 13, 2026
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities Oct 13, 2026
Solving the Continuous Authorization Conundrum Oct 08, 2026
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage Oct 08, 2026
U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance Oct 13, 2026
October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities Oct 13, 2026
Solving the Continuous Authorization Conundrum Oct 08, 2026
CrowdStrike and Anthropic Give Critical Infrastructure Defenders the AI Advantage Oct 08, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Hel
Bugzilla
CVE-2026-96222 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability [fedora-all]
bugzilla·2026-10-15·CVSS 7.4
CVE-2026-96222 [HIGH] CVE-2026-96222 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability [fedora-all]
CVE-2026-96222 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Affected packages:
- System.Security.Cryptography.Xml (release 8.0): 8.0.0 - 8.0.4; fixed 8.0.5
Bugzilla
CVE-2026-96222 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability
bugzilla·2026-10-09·CVSS 7.4
CVE-2026-96222 [HIGH] CVE-2026-96222 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability
CVE-2026-96222 dotnet8.0: Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Affected packages:
- System.Security.Cryptography.Xml (release 8.0): 8.0.0 - 8.0.4; fixed 8.0.5
2026-10-13
Published