CVE-2026-23666
Published: 14 April 2026
Summary
CVE-2026-23666 is a high-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Microsoft .Net Framework. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 30.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of information inputs to prevent malformed inputs from triggering resource exhaustion or crashes in .NET Framework.
Provides denial-of-service protection specifically against network-based resource exhaustion attacks like those enabled by this improper input validation flaw.
Ensures timely flaw remediation through patching of the .NET Framework vulnerability as recommended by MSRC to eliminate the improper input validation issue.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct match to application exploitation causing DoS via malformed network inputs to .NET Framework services.
NVD Description
Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
Deeper analysisAI
CVE-2026-23666 is an improper input validation vulnerability in the .NET Framework that enables a denial-of-service condition. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-755 (Improper Handling of Exceptional Conditions). The flaw affects the .NET Framework component, allowing malformed inputs to trigger resource exhaustion or crashes.
An unauthorized attacker can exploit this vulnerability remotely over a network with low complexity and no user interaction required. By sending specially crafted inputs to a vulnerable .NET Framework application or service exposed to the network, the attacker can cause high-impact availability disruption, such as service crashes or excessive resource consumption, without affecting confidentiality or integrity.
The Microsoft Security Response Center (MSRC) provides an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23666, which details the vulnerability, affected versions, and recommended patches or mitigations for remediation.
Details
- CWE(s)