Key points
- Microsoft rated CVE-2026-58280 as high severity with a CVSS score of 7.5.
- The flaw affects .NET versions 8, 9, 10 and 11 preview releases on Windows, Linux and macOS.
- Patches are available for all affected runtime packages via NuGet.
An unauthorised attacker can cause a denial of service against systems running Microsoft .NET by sending specially crafted network requests. This remote exploit requires no authentication or user interaction, according to the Microsoft Security Update Guide.
The vulnerability, tracked as CVE-2026-58280, stems from uncontrolled recursion within the System.Security.Cryptography.Xml and System.Private.Xml components. Microsoft assigned the issue a high severity rating with a CVSS 3.1 score of 7.5, noting that it allows complete system availability loss.
Affected platforms and versions
The flaw impacts .NET runtime packages across Windows, Linux and macOS architectures. Versions 9.0.0 through 9.0.20 are vulnerable, with 9.0.21 providing the fix. Similarly, versions 8.0.0 through 8.0.31 require an update to 8.0.32.
Pre-release versions of .NET 10 and 11 are also affected. Users of .NET 10.0.0 through 10.0.12 must upgrade to 10.0.13. For .NET 11, versions from preview.1 through rc.1 need the rc.2 patch. All listed NuGet packages for these releases contain the remediation.
What happens next
Teams should immediately audit their environments for the vulnerable .NET runtime versions listed above. Once identified, update the affected NuGet packages to the patched versions specified by Microsoft. Monitor system logs for signs of service disruption or unusual XML processing activity that may indicate exploitation attempts.
Why this attack works
Uncontrolled recursion occurs when a function calls itself repeatedly without proper termination checks or depth limits. In this scenario, an attacker supplies input that triggers deep recursive calls within XML processing libraries. This consumes excessive memory or stack space, causing the application to crash. Teams usually mitigate such risks by enforcing strict input validation and limiting recursion depth. Check whether your applications handle untrusted XML data and ensure they have safeguards against excessive processing loops.
What to do and how to stay safe: Microsoft
- Inventory all systems running .NET versions 8, 9, 10 or 11 to identify exposure to CVE-2026-58280.
- Update affected NuGet packages to the patched versions released by Microsoft.
- Restrict network access to services that process external XML data to reduce attack surface.
- Monitor application logs for crashes or high resource usage indicative of recursion attacks.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-58280?
Microsoft rates the vulnerability as high severity with a CVSS 3.1 score of 7.5.
Which .NET versions are affected by this flaw?
Versions 8.0.0-8.0.31, 9.0.0-9.0.20, 10.0.0-10.0.12 and 11.0.0-preview.1-rc.1 are vulnerable.
Is a patch available for this vulnerability?
Yes, patches are available for all affected versions via updated NuGet packages.
