CVE-2026-32178

CVE-2026-32178 is a spoofing vulnerability in .NET resulting from improper neutralization of special elements, which could allow unauthenticated attackers to conduct network-based spoofing attacks against affected systems. The vulnerability carries a HIGH severity rating with a CVSS score of 7.5, reflecting its network-exploitable nature with low attack complexity and no required user interaction, though it impacts confidentiality rather than availability or integrity. The vulnerability demonstrates minimal exploitation activity based on its very low EPSS score of 0.0004, indicating it ranks below 0.12% of all known CVEs in exploitation likelihood, and it has not been added to CISA's Known Exploited Vulnerabilities catalog. Community attention remains limited with a FAUCET Risk Score of 48.0 out of 100, and there is currently no evidence of active exploitation or widespread availability of functional exploit code. Organizations should prioritize patching based on their .NET deployment footprint and exposure to untrusted network sources, though the lack of active exploitation suggests moderate urgency relative to other vulnerabilities.