CVE-2017-8759: high-severity vulnerability in Microsoft .NET Framework
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 2 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
A vulnerability in Microsoft .NET Framework allows attackers to run malicious code on a computer by tricking users into opening a specially crafted document or application. This is dangerous because it gives attackers full control over the affected system.
CWE-94 (Code Injection) vulnerability in multiple .NET Framework versions enables remote code execution through malicious documents or applications. The attack vector likely involves unsafe deserialization or object instantiation without proper validation. Successful exploitation grants arbitrary code execution in the context of the user running the application.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.