CVE-2026-23666

CVE-2026-23666 is an improper input validation vulnerability affecting the .NET Framework that permits remote denial of service attacks. An unauthenticated attacker can exploit this flaw over the network without requiring user interaction or special privileges. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network attack vector and low attack complexity, indicating significant risk to availability but no impact on confidentiality or integrity. The vulnerability demonstrates minimal exploitation activity to date, with no active exploitation reported and an EPSS score of 0.0011 indicating it ranks lower than most CVEs in terms of real-world exploitation likelihood. No public exploit code is currently available, and the vulnerability remains inactive on the Known Exploited Vulnerabilities (KEV) catalog. The FAUCET Risk Score of 47.0/100 suggests moderate concern, though current community attention and exploitation pressure remain low.