# CVE-2026-108398: .NET Framework Security Feature Bypass Vulnerability CVE-2026-108398 is fixed in 24 products on 1 platform, first by KB5126868, released October 13, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-108398 - Priority: High - CVSS: 8.8 (Important) - EPSS: 0.0078 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: yes - Vendor exploitability assessment: Exploitation Less Likely - Published: Oct 13, 2026 - Weakness: Untrusted Search Path - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108398 ## Description

Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.

## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607 | 14393.9612 | [KB5126868](https://patchblox.com/security/data/fix/microsoft/kb5126868.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 | 14393.9612 | [KB5126868](https://patchblox.com/security/data/fix/microsoft/kb5126868.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019 | | [KB5127666](https://patchblox.com/security/data/fix/microsoft/kb5127666.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.7.2 on Windows 10 version 1809 | | [KB5127666](https://patchblox.com/security/data/fix/microsoft/kb5127666.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 1809 | | [KB5127685](https://patchblox.com/security/data/fix/microsoft/kb5127685.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 21H2 | | [KB5127683](https://patchblox.com/security/data/fix/microsoft/kb5127683.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8 on Windows 10 version 22H2 | | [KB5127683](https://patchblox.com/security/data/fix/microsoft/kb5127683.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019 | | [KB5127685](https://patchblox.com/security/data/fix/microsoft/kb5127685.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022 | | [KB5127687](https://patchblox.com/security/data/fix/microsoft/kb5127687.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 21H2 | | [KB5127689](https://patchblox.com/security/data/fix/microsoft/kb5127689.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 10 version 22H2 | | [KB5127689](https://patchblox.com/security/data/fix/microsoft/kb5127689.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 23H2 | | [KB5127692](https://patchblox.com/security/data/fix/microsoft/kb5127692.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 24H2 | | [KB5127690](https://patchblox.com/security/data/fix/microsoft/kb5127690.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 25H2 | | [KB5127690](https://patchblox.com/security/data/fix/microsoft/kb5127690.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows 11 version 26H2 | | [KB5127694](https://patchblox.com/security/data/fix/microsoft/kb5127694.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022 | | [KB5127693](https://patchblox.com/security/data/fix/microsoft/kb5127693.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025 | | [KB5127690](https://patchblox.com/security/data/fix/microsoft/kb5127690.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 | | [KB5127667](https://patchblox.com/security/data/fix/microsoft/kb5127667.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2 | | [KB5127668](https://patchblox.com/security/data/fix/microsoft/kb5127668.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.8 on Windows 10 version 1607 | | [KB5127684](https://patchblox.com/security/data/fix/microsoft/kb5127684.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.8 on Windows Server 2012 | | [KB5127686](https://patchblox.com/security/data/fix/microsoft/kb5127686.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.8 on Windows Server 2012 R2 | | [KB5127688](https://patchblox.com/security/data/fix/microsoft/kb5127688.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.8 on Windows Server 2016 | | [KB5127684](https://patchblox.com/security/data/fix/microsoft/kb5127684.md) | Oct 13, 2026 | | Microsoft | Microsoft .NET Framework 4.8.1 on Windows 11 version 26H1 | | [KB5127691](https://patchblox.com/security/data/fix/microsoft/kb5127691.md) | Oct 13, 2026 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo