CVE-2026-26171
Published: 14 April 2026
Summary
CVE-2026-26171 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft .Net. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 32.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates network-based denial-of-service attacks by implementing protections against resource exhaustion like rate limiting and traffic filtering.
Protects system resources from unauthorized consumption by enforcing allocation limits tailored to prevent exhaustion in .NET processes.
Ensures timely remediation of the specific uncontrolled resource consumption flaw in .NET through identification, reporting, and patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables application-layer DoS via exploitation of uncontrolled resource consumption (CWE-400/611) in a network-reachable .NET component, matching T1499.004 Application or System Exploitation.
NVD Description
Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.
Deeper analysisAI
CVE-2026-26171 is an uncontrolled resource consumption vulnerability in .NET that enables an unauthorized attacker to cause a denial of service over a network. Published on 2026-04-14, it is associated with CWEs-400 (Uncontrolled Resource Consumption) and CWE-611, and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with no confidentiality or integrity effects.
The vulnerability can be exploited by any unauthorized attacker with network access to a vulnerable .NET instance, requiring low complexity and no privileges or user interaction. Successful exploitation results in significant resource exhaustion, leading to denial of service on the targeted system.
Mitigation details are available in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171.
Details
- CWE(s)