CVE-2026-96237

Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

This vulnerability is rated Important rather than Critical because successful exploitation requires specific environmental preconditions and user interaction, such as configuring untrusted package repositories or intercepting package feed traffic during build operations. In Red Hat environments, the issue primarily exposes development workstations and automated build pipelines utilizing the .NET SDK to install or repair workloads. Standard runtime-only container images and server deployments that do not perform SDK workload management operations remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.