CVE-2024-26190

highpriority · track · 1EPSS 0.030 · 87 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.99% (87th) EPSS

CVSS 7.5 · high

Is it mine?

110 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Microsoft QUIC Denial of Service Vulnerability

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixed.NET 7.0msrc_csaf
7.0.17:Monthly Rollup:https://support.microsoft.com/help/5036451
https://support.microsoft.com/help/5036451
Fixed.NET 8.0msrc_csaf
8.0.3:Security Update:https://support.microsoft.com/help/5036452
https://support.microsoft.com/help/5036452
FixedMicrosoft Visual Studio 2022 version 17.4msrc_csaf
17.4.17:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
FixedMicrosoft Visual Studio 2022 version 17.6msrc_csaf
17.6.13:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
FixedMicrosoft Visual Studio 2022 version 17.8msrc_csaf
17.8.8:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
FixedMicrosoft Visual Studio 2022 version 17.9msrc_csaf
17.9.3:Security Update:https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
FixedPowerShell 7.3msrc_csaf
7.3.12:Security Update:https://github.com/PowerShell/Announcements/issues/73
https://github.com/PowerShell/Announcements/issues/73
FixedPowerShell 7.4msrc_csaf
7.4.2:Security Update:https://github.com/PowerShell/Announcements/issues/73
https://github.com/PowerShell/Announcements/issues/73
FixedWindows 11 Version 22H2 for ARM64-based Systemsmsrc_csaf
10.0.22621.3296:Security Update:https://support.microsoft.com/help/5035853
https://support.microsoft.com/help/5035853
FixedWindows 11 Version 22H2 for x64-based Systemsmsrc_csaf
10.0.22621.3296:Security Update:https://support.microsoft.com/help/5035853
https://support.microsoft.com/help/5035853
FixedWindows 11 Version 23H2 for ARM64-based Systemsmsrc_csaf
10.0.22631.3296:Security Update:https://support.microsoft.com/help/5035853
https://support.microsoft.com/help/5035853
FixedWindows 11 Version 23H2 for x64-based Systemsmsrc_csaf
10.0.22631.3296:Security Update:https://support.microsoft.com/help/5035853
https://support.microsoft.com/help/5035853
FixedWindows 11 version 21H2 for ARM64-based Systemsmsrc_csaf
10.0.22000.2836:Security Update:https://support.microsoft.com/help/5035854
https://support.microsoft.com/help/5035854
FixedWindows 11 version 21H2 for x64-based Systemsmsrc_csaf
10.0.22000.2836:Security Update:https://support.microsoft.com/help/5035854
https://support.microsoft.com/help/5035854
FixedWindows Server 2022msrc_csaf
10.0.20348.2340:Security Update:https://support.microsoft.com/help/5035857
https://support.microsoft.com/help/5035857
FixedWindows Server 2022 (Server Core installation)msrc_csaf
10.0.20348.2340:Security Update:https://support.microsoft.com/help/5035857
https://support.microsoft.com/help/5035857
FixedWindows Server 2022, 23H2 Edition (Server Core installation)msrc_csaf
10.0.25398.763:Security Update:https://support.microsoft.com/help/5035856
https://support.microsoft.com/help/5035856

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:Csecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · secure@microsoft.com USexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-400USCWE-400US

affected products (110)

Products and version ranges known to be affected.

Microsoft .NET Framework 7.0all versionscert_bundDEcpe:/a:microsoft:.net_framework:7.0
Microsoft .NET Framework 8.0all versionscert_bundDEcpe:/a:microsoft:.net_framework:8.0
Microsoft Visual Studio 2022 version 17.4all versionscert_bundDE
Microsoft Visual Studio 2022 version 17.6all versionscert_bundDE
Microsoft Visual Studio 2022 version 17.8all versionscert_bundDE
Microsoft Visual Studio 2022 version 17.9all versionscert_bundDE
Microsoft Visual Studio Codeall versionscert_bundDEcpe:/a:microsoft:visual_studio_code:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Microsoft Visual Studio 2022≤ version 17.8cert_bundDE
Microsoft Visual Studio 2022≤ version 17.6cert_bundDE
Microsoft Visual Studio 2022≤ version 17.9cert_bundDE
Microsoft Visual Studio 2022≤ version 17.4cert_bundDE
Microsoft .NET 7.0all versionsenisa_euvdEU
Microsoft .NET 7.07.0.0 → 7.0.17enisa_euvdEU
Microsoft .NET 8.0all versionsenisa_euvdEU
Microsoft .NET 8.01.0.0 → 8.0.3enisa_euvdEU
Microsoft .NET 8.08.0 → 8.0.3enisa_euvdEU

showing 20 of 110

advisories (6)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-0611Microsoft Visual Studio 2022: Mehrere SchwachstellenDeutsch2024-03-12csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio 2022, Microsoft Visual Studio Code und Microsoft .NET Framework ausnutzen, um einen Denial of Service Angriff durchzuführen oder seine Privilegien zu erweitern.
WID-SEC-W-2024-0619Microsoft Windows: Mehrere SchwachstellenDeutsch2024-03-12csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Microsoft Windows ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebigen Programmcode auszuführen, seine Privilegien zu erweitern, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Sicherheitsvorkehrungen zu umgehen oder Infor mationen offenzulegen.
msrc_CVE-2024-26190Microsoft QUIC Denial of Service Vulnerability2024-03-12csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
BIT-dotnet-2024-26190Microsoft QUIC Denial of Service Vulnerability2024-06-04vendor · osvUS
Microsoft QUIC Denial of Service Vulnerability
BIT-dotnet-sdk-2024-26190Microsoft QUIC Denial of Service Vulnerability2024-06-04vendor · osvUS
Microsoft QUIC Denial of Service Vulnerability
BIT-powershell-2024-26190Microsoft QUIC Denial of Service Vulnerability2025-09-04vendor · osvUS
Microsoft QUIC Denial of Service Vulnerability

also known as (6)

Other names and identifiers for this entity.

CNNVD-202403-983 cnnvd
EUVD-2024-23466 enisa_euvd
BDU:2024-02190 fstec_bdu
BIT-dotnet-2024-26190osv
BIT-dotnet-sdk-2024-26190osv
BIT-powershell-2024-26190osv

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund msrc_csaf NVD CVE.org MITRE

published 2024-03-12modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan