{"metadata": {"vulnerability": "CVE-2026-70035", "count": 29, "kinds": {"milestone": 9, "sighting": 5, "kev": 0, "other": 15}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.generator.date"}, {"timestamp": "2026-08-03T23:13:30.018Z", "date_only": false, "value": "2026-08-03T23:13:30.018Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-70035", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70035", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": false, "value": "2026-10-08T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70035", "record": "FKIE_CVE-2026-70035", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-13T11:56:15Z", "date_only": false, "value": "2026-10-13T11:56:15.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426", "record": "CVE-2026-70035", "field": "creation_timestamp", "uuid": "cbd817e6-ce86-4878-9fa8-9cf803d6dcaa", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0426"}, {"timestamp": "2026-10-13T14:00:00Z", "date_only": false, "value": "2026-10-13T14:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70035", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-13T18:56:15.788Z", "date_only": false, "value": "2026-10-13T18:56:15.788419Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0426", "record": "NCSC-2026-0426", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-13T19:01:15.742Z", "date_only": false, "value": "2026-10-13T19:01:15.742Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-70035", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:19:14.490Z", "date_only": false, "value": "2026-10-13T19:19:14.490", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70035", "record": "FKIE_CVE-2026-70035", "field": "published"}, {"timestamp": "2026-10-13T20:53:46Z", "date_only": false, "value": "2026-10-13T20:53:46Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-4J9V-H7PP-725H", "record": "GHSA-4J9V-H7PP-725H", "field": "published"}, {"timestamp": "2026-10-13T20:53:47Z", "date_only": false, "value": "2026-10-13T20:53:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-4J9V-H7PP-725H", "record": "GHSA-4J9V-H7PP-725H", "field": "modified"}, {"timestamp": "2026-10-13T21:30:58Z", "date_only": false, "value": "2026-10-13T21:30:58.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/64ee4a71955f65a801790ed533374bdc", "record": "CVE-2026-70035", "field": "creation_timestamp", "uuid": "1d8db6c8-40b5-4bf4-a745-789c2fa7518b", "content": "# CVE-2026-70035: CVE-2026-70035: Insecure Deserialization Remote Code Execution in Microsoft .NET Framework and .NET Runtime\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-10-13\n> **Full Report:** https://cvereports.com/reports/CVE-2026-70035\n\n## Summary\nCVE-2026-70035 is a high-severity Remote Code Execution (RCE) vulnerability in Microsoft .NET Framework, .NET runtime, and Visual Studio caused by improper handling during the deserialization of untrusted data (CWE-502). An unauthenticated attacker can execute arbitrary code within the context of the affected process by delivering a crafted serialized payload.\n\n## TL;DR\nAn insecure deserialization vulnerability in .NET allows unauthenticated attackers to execute arbitrary code via crafted object graphs requiring user interaction.\n\n## Technical Details\n\n- **CWE ID**: CWE-502 (Deserialization of Untrusted Data)\n- **CVSSv3.1 Score**: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)\n- **Attack Vector**: Network\n- **Privileges Required**: None\n- **User Interaction**: Required\n- **Exploit Status**: Unproven / None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Microsoft .NET 8.0\n- Microsoft .NET 9.0\n- Microsoft .NET 10.0\n- Microsoft .NET 11.0\n- Microsoft .NET Framework 3.5\n- Microsoft .NET Framework 4.6.2\n- Microsoft .NET Framework 4.7\n- Microsoft .NET Framework 4.7.1\n- Microsoft .NET Framework 4.7.2\n- Microsoft .NET Framework 4.8\n- Microsoft .NET Framework 4.8.1\n- Microsoft Visual Studio 2022 version 17.14\n- Microsoft Visual Studio 2026 version 18.10\n- **.NET**: >= 8.0.0, < 8.0.32 (Fixed in: `8.0.32`)\n- **.NET**: >= 9.0.0, < 9.0.21 (Fixed in: `9.0.21`)\n- **.NET**: >= 10.0.0, < 10.0.13 (Fixed in: `10.0.13`)\n- **.NET Framework**: < 4.8.9363.0 (Fixed in: `4.8.9363.0`)\n- **Visual Studio 2022**: >= 17.14.0, < 17.14.42 (Fixed in: `17.14.42`)\n\n## Mitigation\n\n- Apply official vendor security updates for .NET runtime, .NET Framework, and Visual Studio.\n- Replace legacy binary and polymorphic serializers with modern non-polymorphic formats such as System.Text.Json.\n- Implement strict custom SerializationBinder type whitelisting for applications that must deserialize binary data.\n\n**Remediation Steps:**\n1. Identify all installed instances of .NET runtimes (8.0, 9.0, 10.0, 11.0) and .NET Framework.\n2. Upgrade .NET 8.0 installations to version 8.0.32 or higher.\n3. Upgrade .NET 9.0 installations to version 9.0.21 or higher.\n4. Upgrade .NET 10.0 installations to version 10.0.13 or higher.\n5. Apply October 2026 Microsoft Security Updates for .NET Framework via Windows Update.\n6. Upgrade Visual Studio 2022 to version 17.14.42 and Visual Studio 2026 to 18.10.4.\n\n## References\n\n- [Microsoft Security Response Center Vulnerability Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70035)\n- [CVE.org CVE-2026-70035 Record](https://www.cve.org/CVERecord?id=CVE-2026-70035)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-70035) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/64ee4a71955f65a801790ed533374bdc"}, {"timestamp": "2026-10-13T22:44:25.146Z", "date_only": false, "value": "2026-10-13T22:44:25.146881Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117436020469140482", "record": "CVE-2026-70035", "field": "creation_timestamp", "uuid": "7633452b-2304-42df-800e-98e4f33e46a3", "content": "CVE-2026-70035 .NET Framework Remote Code Execution Vulnerability Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.\nhttps://www.cve.org/CVERecord?id=CVE-2026-70035https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70035#Microsoft #.NET10.0 #.NET11.0 #.NET8.0 #.NET9.0 #Microsoft.NETFramework3.5 #Microsoft.NETFramework3.5AND4.6.2/4.7/4.7.1/4.7.2 #Microsoft.NETFramework3.5AND4.7.2 #Microsoft.NETFramework3.5AND4.8 #Microsoft.NETFramework3.5AND4.8.1 #Microsoft.NETFramework4.6.2/4.7/4.7.1/4.7.2 #Microsoft.NETFramework4.8 #Microsoft.NETFramework4.8.1 #MicrosoftVisualStudio2022version17.14 #MicrosoftVisualStudio2026version18.10#CVE_2026_70035#bot", "url": "https://infosec.exchange/users/cve/statuses/117436020469140482"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "last_revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "initial_release_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1313", "record": "CERTFR-2026-AVI-1313", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1316", "record": "CERTFR-2026-AVI-1316", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-14T01:49:33Z", "date_only": false, "value": "2026-10-14T01:49:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25", "record": "CVE-2026-70035", "field": "creation_timestamp", "uuid": "20acf6ec-a98d-4198-8aa4-785a25472a95", "url": "https://www.acn.gov.it/portale/w/aggiornamenti-mensili-microsoft-25"}, {"timestamp": "2026-10-14T03:56:47.749Z", "date_only": false, "value": "2026-10-14T03:56:47.749Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-70035", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T04:18:28.890Z", "date_only": false, "value": "2026-10-14T04:18:28.890", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-70035", "record": "FKIE_CVE-2026-70035", "field": "lastModified"}, {"timestamp": "2026-10-14T07:16:29.565Z", "date_only": false, "value": "2026-10-14T07:16:29.565343Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mxsyuv52ta2n", "record": "CVE-2026-70035", "field": "creation_timestamp", "uuid": "618650ec-e7ed-4c37-85e9-ed55f6fed485", "content": "CVE-2026-70035 is a remote code execution flaw in Microsoft .NET Windows Desktop Runtime (WPF), caused by unsafe deserialization in XAML and XPS processing. No exploitation is confirmed. Microsoft has released patched runtimes.", "url": "https://bsky.app/profile/suriq.io/post/3mxsyuv52ta2n"}, {"timestamp": "2026-10-15T22:30:07.222Z", "date_only": false, "value": "2026-10-15T22:30:07.222Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-70035", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T22:30:07.222Z", "date_only": false, "value": "2026-10-15T22:30:07.222Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / microsoft", "record": "CVE-2026-70035", "field": "containers.cna.providerMetadata.dateUpdated"}]}