CVE-2026-70194

Name of the Vulnerable Software and Affected Versions Microsoft.NETCore.App.Runtime.linux-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.linux-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.linux-musl-arm versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.linux-musl-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.linux-musl-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.linux-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.osx-arm64 versions 11.0.0-preview.1 through 11.0.0-rc.1 Microsoft.NETCore.App.Runtime.osx-x64 versions 11.0.0-preview.1 through 11.0.0-rc.1

Description Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature over a network. Specifically, in .NET 11, post-handshake TLS client authentication can fail to verify the client certificate, which allows mutual-authentication requirements to be bypassed within System.Net.Security.

Recommendations Update Microsoft.NETCore.App.Runtime.linux-arm to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.linux-arm64 to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.linux-musl-arm to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.linux-musl-arm64 to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.linux-musl-x64 to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.linux-x64 to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.osx-arm64 to version 11.0.0-rc.2 Update Microsoft.NETCore.App.Runtime.osx-x64 to version 11.0.0-rc.2 Recompile and redeploy any self-contained applications targeting the affected versions.