Cyber Posture

CVE-2026-26171

High

Published: 14 April 2026

Published
14 April 2026
Modified
07 May 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0053 67.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-26171 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Microsoft .Net. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 32.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).

Threat & Defense at a Glance

What attackers do: exploitation maps to Application or System Exploitation (T1499.004). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates network-based denial-of-service attacks by implementing protections against resource exhaustion like rate limiting and traffic filtering.

prevent

Protects system resources from unauthorized consumption by enforcing allocation limits tailored to prevent exhaustion in .NET processes.

prevent

Ensures timely remediation of the specific uncontrolled resource consumption flaw in .NET through identification, reporting, and patching.

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Directly enables application-layer DoS via exploitation of uncontrolled resource consumption (CWE-400/611) in a network-reachable .NET component, matching T1499.004 Application or System Exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

Deeper analysisAI

CVE-2026-26171 is an uncontrolled resource consumption vulnerability in .NET that enables an unauthorized attacker to cause a denial of service over a network. Published on 2026-04-14, it is associated with CWEs-400 (Uncontrolled Resource Consumption) and CWE-611, and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high-impact availability disruption with no confidentiality or integrity effects.

The vulnerability can be exploited by any unauthorized attacker with network access to a vulnerable .NET instance, requiring low complexity and no privileges or user interaction. Successful exploitation results in significant resource exhaustion, leading to denial of service on the targeted system.

Mitigation details are available in the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26171.

Details

CWE(s)

Affected Products

microsoft
.net
10.0.0 — 10.0.6 · 8.0.0 — 8.0.26 · 9.0.0 — 9.0.15
microsoft
powershell
7.5 — 7.5.6 · 7.6 — 7.6.1

CVEs Like This One

CVE-2026-26127Same product: Apple Macos
CVE-2026-32203Same product: Apple Macos
CVE-2025-21171Same product: Apple Macos
CVE-2026-21218Same product: Apple Macos
CVE-2026-32178Same product: Apple Macos
CVE-2026-33116Same product: Apple Macos
CVE-2025-21172Same product: Apple Macos
CVE-2026-20652Same product: Apple Macos
CVE-2026-20650Same product: Apple Macos
CVE-2026-5883Same product: Apple Macos

References