The Microsoft .NET Core installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-87697)

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-96224, CVE-2026-96235)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3374 advisory.

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
    (CVE-2026-114148)

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft .NET Core SDK installations on the remote host are missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory.

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to bypass a security feature over a network. (CVE-2026-70188)

  - Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an     unauthorized attacker to perform tampering over a network. (CVE-2026-88092)

  - Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a     network. (CVE-2026-105016)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c7c459ff4d advisory.

    Update to .NET SDK 10.0.113 and Runtime 10.0.13

    Fixes: CVE-2026-102870,CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-     2026-70035,CVE-2026-70159,CVE-2026-70161,CVE-2026-70162,CVE-2026-70165,CVE-2026-70174,CVE-2026-70175,CVE-     2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-2026-70186,CVE-2026-70188,CVE-2026-70190,CVE-2026-70196,CVE-     2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-     2026-92707,CVE-2026-96224,CVE-2026-96225,CVE-2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-     2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96957,CVE-     2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.113.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/10.0/10.0.13/10.0.13.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6cdafc7e45 advisory.

    Update to .NET SDK 8.0.132 and Runtime 8.0.32

    Fixes: CVE-2026-105016,CVE-2026-58280,CVE-2026-66822,CVE-2026-69651,CVE-2026-70007,CVE-2026-70035,CVE-     2026-70159,CVE-2026-70162,CVE-2026-70174,CVE-2026-70175,CVE-2026-70179,CVE-2026-70181,CVE-2026-70183,CVE-     2026-70186,CVE-2026-70188,CVE-2026-70196,CVE-2026-70197,CVE-2026-83520,CVE-2026-84008,CVE-2026-85363,CVE-     2026-85790,CVE-2026-87697,CVE-2026-88092,CVE-2026-92707,CVE-2026-96222,CVE-2026-96224,CVE-2026-96225,CVE-     2026-96229,CVE-2026-96230,CVE-2026-96231,CVE-2026-96232,CVE-2026-96233,CVE-2026-96234,CVE-2026-96235,CVE-     2026-96236,CVE-2026-96237,CVE-2026-96238,CVE-2026-96958,CVE-2026-96959,CVE-2026-96960

    Release Notes:

    - SDK: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.132.md
    - Runtime: https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.32/8.0.32.md

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3367 advisory.

    Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker     to execute code over a network. (CVE-2026-102870)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-109468)

    A vulnerability in the Node.js Brotli decoder can result in an out-of-bounds memory write when processing     crafted Brotli input. Successful exploitation may lead to memory corruption and remote code execution.
    (CVE-2026-111497)

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
    (CVE-2026-114148)

    Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70159)

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

    Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over     a network. (CVE-2026-70179)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70181)

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET     Core allows an authorized attacker to elevate privileges over a network. (CVE-2026-70183)

    Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-70186)

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-83520)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-84008)

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized     attacker to perform spoofing over a network. (CVE-2026-96222)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96225)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96231)

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96233)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-96236)

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     execute code over a network. (CVE-2026-96237)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96958)

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-96959)

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-96960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

Note that Nessus relies on the presence of the package as reported by the vendor.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3366 advisory.

    Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker     to execute code over a network. (CVE-2026-102870)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-109468)

    Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
    (CVE-2026-114148)

    Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-58280)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-69651)

    Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70007)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70159)

    Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a     network. (CVE-2026-70175)

    Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over     a network. (CVE-2026-70179)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-70181)

    Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET     Core allows an authorized attacker to elevate privileges over a network. (CVE-2026-70183)

    Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. (CVE-2026-70186)

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-70197)

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
    (CVE-2026-83520)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-84008)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96225)

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to     elevate privileges locally. (CVE-2026-96231)

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96233)

    Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to     deny service over a network. (CVE-2026-96236)

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to     execute code over a network. (CVE-2026-96237)

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a     security feature over a network. (CVE-2026-96957)

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
    (CVE-2026-96958)

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny     service over a network. (CVE-2026-96959)

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service     over a network. (CVE-2026-96960)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
366546	Security Update for Microsoft .NET Core (October 2026)	Nessus	Windows	2026/10/16	2026/10/19	critical
374343	Amazon Linux 2023 : aspnetcore-runtime-9.0, aspnetcore-runtime-dbg-9.0, aspnetcore-targeting-pack-9.0 (ALAS2023-2026-3374)	Nessus	Amazon Linux Local Security Checks	2026/10/30	2026/10/30	high
366547	Security Update for Microsoft .NET Core SDK (October 2026)	Nessus	Windows	2026/10/16	2026/10/19	critical
371740	Fedora 43 : dotnet10.0 (2026-c7c459ff4d)	Nessus	Fedora Local Security Checks	2026/10/24	2026/10/24	critical
371923	Fedora 44 : dotnet8.0 (2026-6cdafc7e45)	Nessus	Fedora Local Security Checks	2026/10/25	2026/10/25	critical
374355	Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-3367)	Nessus	Amazon Linux Local Security Checks	2026/10/30	2026/11/2	critical
367619	Linux Distros Unpatched Vulnerability : CVE-2026-70197	Nessus	Misc.	2026/10/20	2026/10/21	high
374321	Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-3366)	Nessus	Amazon Linux Local Security Checks	2026/10/30	2026/10/30	high

検出

プラグインの検索

critical

high

critical

critical

critical

critical

high

high