Security Update for Microsoft .NET Core (October 2026)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(366546);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/16");


  script_cve_id(
    "CVE-2026-58280",
    "CVE-2026-66822",
    "CVE-2026-69651",
    "CVE-2026-70007",
    "CVE-2026-70035",
    "CVE-2026-70162",
    "CVE-2026-70174",
    "CVE-2026-70197",
    "CVE-2026-83520",
    "CVE-2026-84008",
    "CVE-2026-85363",
    "CVE-2026-85790",
    "CVE-2026-87697",
    "CVE-2026-96222",
    "CVE-2026-96224",
    "CVE-2026-96225",
    "CVE-2026-96229",
    "CVE-2026-96231",
    "CVE-2026-96232",
    "CVE-2026-96233",
    "CVE-2026-96234",
    "CVE-2026-96235",
    "CVE-2026-96958",
    "CVE-2026-96959",
    "CVE-2026-96960",
    "CVE-2026-102870",
    "CVE-2026-105016"
  );
  script_xref(name:"IAVA", value:"2026-A-1124");

  script_name(english:"Security Update for Microsoft .NET Core (October 2026)");

  script_set_attribute(attribute:"synopsis", value:
"The Microsoft .NET Core installations on the remote host are affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by
multiple vulnerabilities as referenced in the vendor advisory.

  - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-87697)

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-96224, CVE-2026-96235)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a
    network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/445");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/446");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/447");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/448");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/449");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/450");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/451");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/454");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/456");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/466");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/467");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/468");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/469");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/470");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/471");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/474");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/475");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/476");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/477");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/479");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/480");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/481");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/482");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/483");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/488");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/489");
  script_set_attribute(attribute:"see_also", value:"https://github.com/dotnet/announcements/issues/490");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5130034");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5130035");
  script_set_attribute(attribute:"see_also", value:"https://support.microsoft.com/help/5130036");
  script_set_attribute(attribute:"see_also", value:"https://dotnet.microsoft.com/download/dotnet/8.0");
  # https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.32.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f66fd547");
  script_set_attribute(attribute:"see_also", value:"https://dotnet.microsoft.com/download/dotnet/9.0");
  # https://github.com/dotnet/core/blob/main/release-notes/9.0/9.0.21/9.0.21.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?399b6da0");
  script_set_attribute(attribute:"see_also", value:"https://dotnet.microsoft.com/download/dotnet/10.0");
  # https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4756b61b");
  script_set_attribute(attribute:"solution", value:
"Update .NET Core, remove vulnerable packages and refer to vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-105016");

  script_cwe_id(59,94,122,125,183,190,201,295,346,358,405,407,416,502,674,770,787);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:.net_core");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_dotnet_core_win.nbin");
  script_require_keys("installed_sw/.NET Core Windows");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [{'scope': 'target', 'match': {'os': 'windows'}}],
  'checks': [{
    'product': {'name': '.NET Core Windows', 'type': 'app'},
    'check_algorithm': 'default',
    'constraints': [{
      'min_version': '8',
      'fixed_version': '8.0.32',
      'report': {'cves': [
        'CVE-2026-58280','CVE-2026-66822','CVE-2026-69651','CVE-2026-70007','CVE-2026-70035','CVE-2026-70162',
        'CVE-2026-70174','CVE-2026-70197','CVE-2026-83520','CVE-2026-84008','CVE-2026-85363','CVE-2026-87697',
        'CVE-2026-96222','CVE-2026-96224','CVE-2026-96225','CVE-2026-96229','CVE-2026-96231','CVE-2026-96232',
        'CVE-2026-96233','CVE-2026-96234','CVE-2026-96235','CVE-2026-96958','CVE-2026-96959','CVE-2026-96960',
        'CVE-2026-105016'
      ]}
    },{
      'min_version': '9',
      'fixed_version': '9.0.21',
      'report': {'cves': [
        'CVE-2026-58280','CVE-2026-66822','CVE-2026-69651','CVE-2026-70007','CVE-2026-70035','CVE-2026-70162',
        'CVE-2026-70174','CVE-2026-70197','CVE-2026-83520','CVE-2026-84008','CVE-2026-85363','CVE-2026-85790',
        'CVE-2026-87697','CVE-2026-96224','CVE-2026-96225','CVE-2026-96229','CVE-2026-96231','CVE-2026-96232',
        'CVE-2026-96233','CVE-2026-96234','CVE-2026-96235','CVE-2026-96958','CVE-2026-96959','CVE-2026-96960',
        'CVE-2026-105016'
      ]}
    },{
      'min_version': '10',
      'fixed_version': '10.0.13',
      'report': {'cves': [
        'CVE-2026-58280','CVE-2026-66822','CVE-2026-69651','CVE-2026-70007','CVE-2026-70035','CVE-2026-70162',
        'CVE-2026-70174','CVE-2026-70197','CVE-2026-83520','CVE-2026-84008','CVE-2026-85363','CVE-2026-87697',
        'CVE-2026-96224','CVE-2026-96225','CVE-2026-96229','CVE-2026-96231','CVE-2026-96232','CVE-2026-96233',
        'CVE-2026-96234','CVE-2026-96235','CVE-2026-96958','CVE-2026-96959','CVE-2026-96960','CVE-2026-102870',
        'CVE-2026-105016'
      ]}
    }]
  }]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);