Security Update for Microsoft .NET Core SDK (March 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from the Microsoft Security Updates API. The text
# itself is copyright (C) Microsoft Corporation.
#
##

include('compat.inc');

if (description)
{
  script_id(302121);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2026-26127", "CVE-2026-26130", "CVE-2026-26131");
  script_xref(name:"MSKB", value:"5081277");
  script_xref(name:"MSKB", value:"5081278");
  script_xref(name:"MSKB", value:"5081276");
  script_xref(name:"MSFT", value:"MS26-5081278");
  script_xref(name:"MSFT", value:"MS26-5081277");
  script_xref(name:"MSFT", value:"MS26-5081276");
  script_xref(name:"IAVA", value:"2026-A-0224-S");

  script_name(english:"Security Update for Microsoft .NET Core SDK (March 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of .NET Core SDK installed on the remote host is 8.x prior to 8.0.125, 8.0.4xx prior to 8.0.419, 9.x prior
to 9.0.115, 9.0.3xx prior to 9.312, or 10.x prior to 10.0.104. It is, therefore, affected by multiple vulnerabilities as
referenced in the vendor advisory:

  - Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network. (CVE-2026-26127)

  - Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to
    deny service over a network. (CVE-2026-26130)

  - Incorrect default permissions in .NET allows an authorized attacker to elevate privileges locally.
    (CVE-2026-26131)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
nuber.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/387");
  # https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.25/8.0.125.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?50d93f68");
  script_set_attribute(attribute:"see_also", value:"https://dotnet.microsoft.com/en-us/download/dotnet/8.0");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5081277");
  # https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.14/9.0.115.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ca1d04c2");
  script_set_attribute(attribute:"see_also", value:"https://dotnet.microsoft.com/download/dotnet/9.0");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5081278");
  # https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.4/10.0.104.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0a4201d8");
  script_set_attribute(attribute:"see_also", value:"https://dotnet.microsoft.com/download/dotnet/10.0");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5081276");
  script_set_attribute(attribute:"solution", value:
"Update .NET Core SDK, remove vulnerable packages and refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-26131");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/13");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:.net_core");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_dotnet_core_sdk_win.nbin");
  script_require_keys("installed_sw/.NET Core SDK Windows", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [{'scope': 'target', 'match': {'os': 'windows', 'paranoia': true}}],
  'checks': [{
    'product': {'name': '.NET Core SDK Windows', 'type': 'app'},
    'check_algorithm': 'default',
    'constraints': [{
      'min_version': '8',
      'fixed_version': '8.0.125',
      'report': {'cves': ['CVE-2026-26130']}
    },{
      'min_version': '8.0.400',
      'fixed_version': '8.0.419',
      'report': {'cves': ['CVE-2026-26130']}
    },{
      'min_version': '9',
      'fixed_version': '9.0.115',
      'report': {'cves': ['CVE-2026-26127', 'CVE-2026-26130']}
    },{
      'min_version': '9.0.300',
      'fixed_version': '9.0.312',
      'report': {'cves': ['CVE-2026-26127', 'CVE-2026-26130']}
    },{
      'min_version': '10',
      'fixed_version': '10.0.104',
      'report': {'cves': ['CVE-2026-26127', 'CVE-2026-26130', 'CVE-2026-26131']}
    }]
  }]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);