Possible false positive - CVE-2026-69522 (.NET Framework RCE) still flagged after KB5126048 is installed

InsightVM
1

Hi all,

We're seeing what looks like a false positive for CVE-2026-69522 on Windows Server 2019 (1809) hosts running .NET Framework 4.8, and wanted to check if anyone else has hit this before opening a support ticket.

**What InsightVM reports:**

Vulnerable software installed: Microsoft .NET Framework 4.8
(HKEY_LOCAL_MACHINE\Software\Microsoft\NET Framework Setup\NDP\v4\Full)

Vulnerable OS: Microsoft Windows Server 2019 Datacenter Edition 1809

Proof is based on:

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationFramework.dll exists
  • PresentationFramework.dll has version 4.8.4806.0

**What we verified on our end:**

1. Confirmed KB5126048 ("2026-09, Cumulative Update for .NET Framework 3.5 and 4.8 for Windows Server 2019 for x64") is installed - visible in Windows Update history (installed 2026-09-13) and present in the CBS package store (HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages).

2. Confirmed via Microsoft's own KB article that KB5126048 explicitly addresses CVE-2026-69522 (and CVE-2026-62886) for this OS/.NET combination.

3. To rule out an incomplete install, we downloaded the standalone KB5126048 package from the Microsoft Update Catalog, extracted the MSU/CAB layers, and checked the file version of PresentationFramework.dll shipped inside the patch itself:

  • amd64\netfx4-presentationframework...4.0.15744.1204...\PresentationFramework.dll -> 4.8.4806.0
  • msil_presentationframework...4.0.15744.1204...\PresentationFramework.dll -> 4.8.4806.0

So the file version Microsoft ships as the *fixed* version in KB5126048 is the exact same version (4.8.4806.0) InsightVM is flagging as vulnerable. There's no pending file rename operation, no reboot-pending flag, and the on-disk file matches the patched file byte-for-byte version.

**Our working theory:** the vulnerability check for CVE-2026-69522 may be using an off-by-one comparison (e.g. "<= 4.8.4806.0 is vulnerable" instead of "< 4.8.4806.0 is vulnerable"), causing it to flag the fixed version itself.

Has anyone else seen this on their Server 2019 / .NET 4.8 assets since the September 2026 content update? Any word on whether this is a known issue with the current vulnerability check, or should we go ahead and open a support case with the evidence above?

Thanks!

2

I’ve had my first instance on this today. I thought I’d check in here before I log a support ticket.

1 Like
3

Also seeing this.

1 Like
4

Also seeing this for both CVE-2026-69522 & CVE-2026-62886 on fully patched Server 2019 systems.

1 Like
5

I have now opened a case to Rapid7.

1 Like
6

I have received word from Rapid Support that they have confirmed the error and begun the remediation process.

1 Like
7

False positive. We have also patched this and its still flagging.

8

We have this issue also, our support ticket has been updated to say it will be resolved in todays content update.

10

Hi,
I have received confirmation from Rapid7 that the vulnerability has been resolved. Rapid7 states the following:

"Our Vulnerability Content Engineering team has successfully released a fix for this issue. The check logic has been updated to correctly evaluate the patched file version (4.8.4806.0) as non-vulnerable. This fix is ​​included in content release, version 1.1.4055."

After running a scan this morning, there are no remaining instances of the .NET vulnerability.

1 Like