Security Digest: October 15, 2026 - 27 Critical Vulnerabilities

Today’s digest is dominated by active exploitation in Palo Alto PAN-OS and a broad wave of Microsoft .NET / ASP.NET Core / WPF flaws that can lead to code execution, request smuggling, XSS, denial of service, and local privilege escalation. The immediate priority is to patch internet-facing systems first, then move through .NET runtimes, Windows desktop apps, and XML/certificate-handling components without delay.

· 28 min read

Executive Summary

Today’s digest is dominated by active exploitation in Palo Alto PAN-OS and a broad wave of Microsoft .NET / ASP.NET Core / WPF flaws that can lead to code execution, request smuggling, XSS, denial of service, and local privilege escalation. The immediate priority is to patch internet-facing systems first, then move through .NET runtimes, Windows desktop apps, and XML/certificate-handling components without delay.

Organizations running Palo Alto firewalls, ASP.NET Core apps, Blazor WebAssembly dev servers, WPF desktop applications, or signed XML / PKCS processing should treat this as a same-day remediation event. If you cannot patch immediately, isolate exposed services, restrict access, and increase monitoring for exploitation attempts.

Critical Vulnerabilities

CVE-2026-0322: Palo Alto PAN-OS code injection in firewall management

  • Impact: An authenticated attacker with network access can execute arbitrary code as root on the firewall.
  • Affected Systems: Palo Alto Networks PAN-OS.
  • Immediate Action: Patch now on all internet-facing and remote-access firewalls; review admin access paths immediately.
  • Mitigation: Apply the vendor fix urgently; if patching is delayed, restrict management access to trusted networks only and monitor for suspicious admin activity.

CVE-2026-88092: ASP.NET Core Kestrel request smuggling / desync

  • Impact: Attackers may smuggle requests, bypass controls, or desynchronize front-end and back-end parsing.
  • Affected Systems: Microsoft ASP.NET Core / Microsoft.AspNetCore.Server.Kestrel.Core on affected .NET 8, 9, 10, and preview 11 runtimes.
  • Immediate Action: Update affected runtimes/packages to the patched versions and redeploy all services using Kestrel.
  • Mitigation: Move to 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2 as applicable; restart services after upgrade.

CVE-2026-70174: .NET standard input security check bypass

  • Impact: Remote code execution over the network.
  • Affected Systems: Microsoft .NET environments using the vulnerable component.
  • Immediate Action: Patch all affected .NET deployments now.
  • Mitigation: Install the latest .NET updates and redeploy affected apps.

CVE-2026-96224: WPF pixel-shader parsing corruption

  • Impact: Crafted content can trigger heap out-of-bounds writes/reads and may enable code execution.
  • Affected Systems: Microsoft.WindowsDesktop.App.Runtime on Windows.
  • Immediate Action: Update WPF runtimes used by desktop apps and self-contained packages.
  • Mitigation: Move to patched runtime versions: 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.

CVE-2026-85363: WPF XPS glyph coordinate overflow

  • Impact: Out-of-bounds write and process termination; potential code execution in desktop apps.
  • Affected Systems: Microsoft.WindowsDesktop.App.Runtime on Windows.
  • Immediate Action: Patch all Windows desktop runtimes immediately.
  • Mitigation: Upgrade to the fixed WPF runtime versions and redeploy self-contained apps.

CVE-2026-102870: ASP.NET Core code injection

  • Impact: Unauthorized remote code execution.
  • Affected Systems: Microsoft ASP.NET Core.
  • Immediate Action: Update affected ASP.NET Core packages/runtimes now.
  • Mitigation: Apply the vendor patch and recycle all app instances.

CVE-2026-96235: WPF pixel-shader heap corruption

  • Impact: Heap out-of-bounds write/read; possible code execution after user interaction.
  • Affected Systems: Microsoft.WindowsDesktop.App.Runtime on Windows.
  • Immediate Action: Patch Windows desktop runtimes and any self-contained WPF apps.
  • Mitigation: Upgrade to the patched runtime and redeploy.

CVE-2026-96230: Blazor WebAssembly debug-page XSS

  • Impact: Cross-origin script injection via the unauthenticated /_framework/debug endpoint.
  • Affected Systems: Microsoft.AspNetCore.Components.WebAssembly.Server.
  • Immediate Action: Patch dev servers and stop exposing debug endpoints publicly.
  • Mitigation: Update to 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.

CVE-2026-87697: WPF XPS synthetic hyperlink navigation bypass

  • Impact: Remote code execution after user interaction.
  • Affected Systems: Microsoft.WindowsDesktop.App.Runtime on Windows.
  • Immediate Action: Patch WPF runtimes and review apps that render untrusted XPS content.
  • Mitigation: Upgrade to the fixed runtime and redeploy.

CVE-2026-70007: .NET Framework out-of-bounds write

  • Impact: Remote code execution.
  • Affected Systems: .NET Framework.
  • Immediate Action: Apply Microsoft updates to all supported systems.
  • Mitigation: Install the latest cumulative security updates.

CVE-2026-70035: .NET Framework unsafe deserialization

  • Impact: Remote code execution through untrusted data.
  • Affected Systems: .NET Framework.
  • Immediate Action: Patch immediately and audit deserialization paths.
  • Mitigation: Update affected systems and restrict untrusted input.

CVE-2026-83520: .NET deserialization of untrusted data

  • Impact: Remote code execution.
  • Affected Systems: Microsoft .NET.
  • Immediate Action: Upgrade vulnerable runtimes and apps now.
  • Mitigation: Apply the latest .NET security release.

CVE-2026-62847: Metalama temp-directory code loading on POSIX

  • Impact: Local attackers can plant malicious assemblies and gain code execution in build or IDE processes.
  • Affected Systems: Metalama.Framework, Metalama.Tool on Linux/macOS before 2026.1.19.
  • Immediate Action: Upgrade build agents and developer machines using Metalama.
  • Mitigation: Move to 2026.1.19 or later; review shared CI/build hosts for temp-dir abuse.

CVE-2026-70197: .NET out-of-bounds write

  • Impact: Remote code execution.
  • Affected Systems: Microsoft .NET.
  • Immediate Action: Patch now across all exposed services.
  • Mitigation: Deploy the latest fixed runtime/packages.

CVE-2026-96225: Unix named-mutex and shared-memory path abuse

  • Impact: Local attackers can overwrite files, widen permissions, or elevate privileges on Linux/macOS.
  • Affected Systems: Microsoft.NETCore.App.Runtime on Linux/macOS.
  • Immediate Action: Update runtimes on shared systems and CI agents.
  • Mitigation: Install 8.0.32, 9.0.21, 10.0.13, or 11.0.0-rc.2.

CVE-2026-96231: Unix named-mutex and shared-memory path abuse

  • Impact: Same local privilege-escalation risk on Linux/macOS.
  • Affected Systems: Microsoft.NETCore.App.Runtime on Linux/macOS.
  • Immediate Action: Patch all affected hosts, especially multi-user build systems.
  • Mitigation: Upgrade to the fixed runtime releases.

CVE-2026-84008: SignedCms quadratic CPU exhaustion

  • Impact: Unauthenticated denial of service through CPU exhaustion.
  • Affected Systems: System.Security.Cryptography.Pkcs.
  • Immediate Action: Update cryptography packages in all apps that validate signed CMS data.
  • Mitigation: Move to 8.0.2, 9.0.21, 10.0.13, or 11.0.0-rc.2.

CVE-2026-58280: .NET uncontrolled recursion

  • Impact: Remote denial of service.
  • Affected Systems: Microsoft .NET.
  • Immediate Action: Patch affected applications and services.
  • Mitigation: Apply the latest runtime update.

CVE-2026-70186: ASP.NET Core deadlock

  • Impact: Remote denial of service.
  • Affected Systems: ASP.NET Core.
  • Immediate Action: Update and recycle all web app instances.
  • Mitigation: Deploy the vendor fix immediately.

CVE-2026-96236: ASP.NET Core localization cache growth

  • Impact: Unauthenticated requests can drive unbounded memory growth and crash services.
  • Affected Systems: Microsoft.AspNetCore.Localization.
  • Immediate Action: Patch all public-facing ASP.NET Core apps.
  • Mitigation: Upgrade to the fixed runtime/package versions and restart services.

CVE-2026-69651: .NET inefficient algorithmic complexity

  • Impact: Remote denial of service.
  • Affected Systems: Microsoft .NET.
  • Immediate Action: Patch now on exposed services.
  • Mitigation: Install the latest fixed release.

CVE-2026-96960: Signed XML resource-exhaustion flaw

  • Impact: Unauthenticated denial of service through expensive XML processing.
  • Affected Systems: System.Security.Cryptography.Xml and System.Private.Xml.
  • Immediate Action: Update XML-handling packages immediately.
  • Mitigation: Move to 8.0.5, 9.0.21, 10.0.13, or 11.0.0-rc.2.

CVE-2026-96233: DateTime Hebrew-number parsing out-of-bounds read

  • Impact: Process termination and denial of service.
  • Affected Systems: Microsoft.NETCore.App.Runtime across Windows, Linux, and macOS.
  • Immediate Action: Patch all .NET runtime deployments.
  • Mitigation: Upgrade to the fixed runtime versions and restart apps.

CVE-2026-96959: Signed XML resource-exhaustion flaw

  • Impact: Unauthenticated denial of service.
  • Affected Systems: System.Security.Cryptography.Xml and System.Private.Xml.
  • Immediate Action: Patch XML-processing components now.
  • Mitigation: Install the latest fixed package/runtime versions.

CVE-2026-96232: WPF XAML/XPS unsafe URI and font-handling flaws

  • Impact: Information disclosure, navigation bypass, and potential unsafe content handling in desktop apps.
  • Affected Systems: Microsoft.WindowsDesktop.App.Runtime on Windows.
  • Immediate Action: Update Windows desktop runtimes and any self-contained WPF apps.
  • Mitigation: Move to the patched runtime and redeploy.

CVE-2026-96958: Signed XML resource-exhaustion flaw

  • Impact: Denial of service via expensive XML processing.
  • Affected Systems: System.Security.Cryptography.Xml and System.Private.Xml.
  • Immediate Action: Patch all XML-signing and XML-validation services.
  • Mitigation: Upgrade to the fixed package versions.

CVE-2026-96222: XML certificate-validation weakness

  • Impact: Certificate forgery and token-spoofing paths.
  • Affected Systems: System.Security.Cryptography.Xml version 8.0.0 through 8.0.4.
  • Immediate Action: Update immediately if your app parses XML signatures or X.509 data.
  • Mitigation: Upgrade to 8.0.5.

🚨 ACTIVELY EXPLOITED

  • CVE-2026-0322 — CISA KEV, actively exploited in the wild. Treat as the top priority today.

Previously Alerted

What to Do Now

  1. Patch internet-facing systems first: Palo Alto PAN-OS, ASP.NET Core services, and any public WPF or .NET applications.
  2. Upgrade affected .NET runtimes/packages: target the vendor-fixed releases listed above and redeploy self-contained apps.
  3. Disable or restrict dev/debug endpoints: especially Blazor /_framework/debug and any test-only services exposed to the internet.
  4. Prioritize shared Linux/macOS build hosts: Metalama and Unix mutex/shared-memory flaws can affect CI and developer environments.
  5. Audit XML, PKCS, and certificate parsing: identify services that process signed XML, CMS, or X.509 input from untrusted sources.

Verification: confirm installed runtimes with dotnet --info, inventory self-contained deployments, and verify firewall management versions against vendor guidance. Check for unexpected spikes in CPU, memory, firewall admin logins, build-agent crashes, and requests to debug or XML-processing endpoints.

Monitoring: watch for exploitation indicators on PAN-OS management interfaces, unusual request patterns consistent with smuggling, and repeated malformed XML or certificate payloads. Increase alerting on build hosts for temp-directory tampering and on web apps for high-error-rate traffic and memory growth.

Related Resources

  • Internal: Upcoming deep-dive on today’s .NET and firewall exposure (not yet published).
  • Official vendor advisories: Palo Alto Networks PAN-OS security advisory; Microsoft .NET / ASP.NET Core / WPF advisories linked in each CVE above.

Keep reading