CVE-2026-96222

Name of the Vulnerable Software and Affected Versions System.Security.Cryptography.Xml versions 8.0.0 through 8.0.4

Description Improper certificate validation in KeyInfoX509Data allows the acceptance of serialized certificate formats containing attacker-controlled chain metadata instead of requiring a plain X.509 certificate. This flaw can be leveraged to facilitate certificate forgery and token spoofing over a network.

Recommendations Update System.Security.Cryptography.Xml to version 8.0.5. Install the latest version of .NET and restart applications for the update to take effect. Recompile and redeploy any self-contained applications targeting versions 8.0.0 through 8.0.4.