Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
📦 Bitnami
Not in CISA KEV

CVE-2026-50528 — dotnet

CVE-2026-50528 is a CWE-302 vulnerability in dotnet. A fix is available for dotnet — see the affected versions and patch details below.

.NET Security Feature Bypass Vulnerability

Also known asBIT-dotnet-sdk-2026-50528GHSA-qvw7-jm5c-6hqw
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 16, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-50528.

EPSS Exploitation Probability

via FIRST.org ↗
0.6%probability of exploitation in next 30 days
Lower Risk+0.05%
Lower risk than most CVEs48th percentile — riskier than 48% of all scored CVEsHighest risk
0.06%0.41%0.76%1.11%0.6%0.6%Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
📦dotnet

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Bitnami packages — download data is not available via public APIs for these ecosystems.

Description

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦Bitnamidotnet≥ 8.0.0&&< 8.0.298.0.29

Affected Products

3 products · 6 configurations
Application
.netmicrosoft
≥ 10.0.0 && < 10.0.6
range
Application
visual studio 2022microsoft
≥ 17.14.0 && < 17.14.36
range
Application
visual studio 2026microsoft
≥ 18.7.0 && < 18.7.4
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dotnet, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update dotnet to 8.0.29 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-50528 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant
ProductFixed inAdvisory
Red Hat Enterprise Linux 10dotnet8.0-0:8.0.129-1.el10_2RHSA-2026:41893
Red Hat Enterprise Linux 10dotnet9.0-0:9.0.119-1.el10_2RHSA-2026:41895
Red Hat Enterprise Linux 10dotnet10.0-0:10.0.110-1.el10_2RHSA-2026:41897
Red Hat Enterprise Linux 10.0 Extended Update Supportdotnet8.0-0:8.0.130-1.el10_0RHSA-2026:58566
Red Hat Enterprise Linux 10.0 Extended Update Supportdotnet9.0-0:9.0.120-1.el10_0RHSA-2026:58567
Red Hat Enterprise Linux 8dotnet9.0-0:9.0.119-1.el8_10RHSA-2026:41899
Red Hat Enterprise Linux 8dotnet10.0-0:10.0.110-1.el8_10RHSA-2026:41900
Red Hat Enterprise Linux 8dotnet8.0-0:8.0.129-1.el8_10RHSA-2026:41901

Frequently Asked Questions

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
O3 Security · Impact-Aware SCA

Is CVE-2026-50528 in your dependencies?

Find it across Bitnami, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-50528: dotnet — Fixed in 8.0.29