CVE-2026-96957

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

An IMPORTANT severity security feature bypass vulnerability was found in the .NET (dotnet10.0) packages shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and Red Hat Hardened Images. Improper verification of cryptographic signatures in .NET allows an unauthorized remote attacker, in a scenario requiring user interaction, to bypass a security feature: signature verification for .NET file-based apps can fail to enforce the expected trust decision, with potential impact on the confidentiality, integrity, and availability of the application's trust decisions. A fix for the affected Red Hat products is being pursued through the upstream .NET releases, to which resolution of this flaw is delegated. The dotnet8.0 component in Red Hat Hardened Images is not affected by this issue. Red Hat's severity rating of IMPORTANT (CVSS 3.1 score 8.8) is consistent with the upstream Microsoft assessment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.