System.Security.Cryptography.Xml Spoofing Vulnerability (CVE-2026-96222)

Microsoft has disclosed a high-severity spoofing vulnerability, tracked as CVE-2026-96222, affecting the System.Security.Cryptography.Xml library within .NET environments. The vulnerability resides in how the 'KeyInfoX509Data' component processes certificate information. Specifically, the component fails to strictly require a plain X.509 certificate, instead accepting serialized certificate formats that may include attacker-controlled chain metadata.

This flaw (CWE-295: Improper Certificate Validation) can be leveraged by attackers to perform certificate forgery and token spoofing. By providing maliciously crafted serialized metadata, an attacker may deceive applications that rely on this library to validate cryptographic identities. This vulnerability affects all platforms, including Windows, Linux, and macOS, for applications using the System.Security.Cryptography.Xml NuGet package versions 8.0.0 through 8.0.4. Defenders must prioritize upgrading the library to version 8.0.5 or updating the .NET SDK/runtime environment, and ensure that self-contained applications are recompiled and redeployed to incorporate the fix.

Impact

Successful exploitation of this vulnerability allows an attacker to bypass certificate validation, enabling token spoofing and certificate forgery. This can lead to unauthorized authentication, escalation of privilege, or the circumvention of secure communication protocols in applications utilizing the affected cryptographic library. The vulnerability is applicable to any .NET environment regardless of the host operating system, posing a risk to enterprise infrastructure relying on XML-based cryptographic verification.

Recommendation

• Update the System.Security.Cryptography.Xml NuGet package to version 8.0.5 immediately.
• Install the latest .NET SDK or runtime updates via Visual Studio or the dotnet CLI to ensure comprehensive patching.
• Audit environments for applications using versions 8.0.0 through 8.0.4 of System.Security.Cryptography.Xml by running the 'dotnet --info' command.
• Recompile and redeploy all self-contained applications that have been updated to use the patched version of the library.
• Monitor logs for unusual authentication patterns or cryptographic errors that may indicate failed exploitation attempts using malformed XML signature data.