What’s Vulnerable › Vulnerabilities
CVE-2018-8356
- Severity: medium (CVSS 5.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-07-11 · updated 2026-06-17
- Weakness: CWE-295
Description
A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.
Affected products
- Microsoft Corporation .NET Core: 1.0, 1.1, 2.0
- Microsoft .NET Framework: 3.0-sp2, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.2 (+4)
- Microsoft .Net Framework Developer Pack: 4.7.2
- Microsoft .NET Core: 1.0, 1.1, 2.0
- Microsoft PowerShell Core: 6.0, 6.1
- Microsoft Corporation .NET Core: 1.0, 1.1, 2.0
- Microsoft .NET Framework: 3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2, 3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2, 3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2, 3.5 on Windows 10 for 32-bit Systems, 3.5 on Windows 10 for x64-based Systems, 3.5 on Windows 10 Version 1607 for 32-bit Systems (+57)
- Microsoft .NET Core: 1.0, 1.1, 2.0
References
- http://www.securityfocus.com/bid/104664
- http://www.securitytracker.com/id/1041257
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8356
- http://www.securityfocus.com/bid/104664
- http://www.securitytracker.com/id/1041257
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8356
Get alerted when CVE-2018-8356 or the next vulnerability affects your stack