| Vuln ID | Severity | Asset | STIG | Title | Status | Doc Status | Assigned To | Actions |
|---|---|---|---|---|---|---|---|---|
| V-225236 | CAT II | MONT-WS-92040 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-WS-92040/Checklist/MONT-WS-92040_DotNET4_V2R7_20251023-142306.ckl
Scan Date: 2026-01-14T12:57:25.530570
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-WS-92010 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-WS-92010/Checklist/MONT-WS-92010_DotNET4_V2R7_20251023-141005.ckl
Scan Date: 2026-01-14T12:57:27.786540
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-VSF-004 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-VSF-004/Checklist/MONT-VSF-004_DotNET4_V2R7_20251023-143711.ckl
Scan Date: 2026-01-14T12:57:29.485524
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-VSF-003 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-VSF-003/Checklist/MONT-VSF-003_DotNET4_V2R7_20251023-143732.ckl
Scan Date: 2026-01-14T12:57:30.918773
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-MB-002 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-MB-002/Checklist/MONT-MB-002_DotNET4_V2R7_20251023-152339.ckl
Scan Date: 2026-01-14T12:57:32.355929
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-DP-001 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-DP-001/Checklist/MONT-DP-001_DotNET4_V2R7_20251023-143731.ckl
Scan Date: 2026-01-14T12:57:34.683670
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-DC-003 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-DC-003/Checklist/MONT-DC-003_DotNET4_V2R7_20251023-171946.ckl
Scan Date: 2026-01-14T12:57:36.663331
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-DB-002 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-DB-002/Checklist/MONT-DB-002_DotNET4_V2R7_20251023-143930.ckl
Scan Date: 2026-01-14T12:57:38.504147
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-BE-002 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) was unable to determine a Status but found the below configuration on 10/23/2025: ResultHash: 1E5FAD6C7F6E6F796EB6A2FA1A9D4975C326A325 ~~~~~ C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\SQL2017\x64\FixSqlRegistryKey_x64.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\SQL2017\x64\FixSqlRegistryKey_x86.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\SQL2017\x64\LandingPage.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\SQL2017\x64\ScenarioEngine.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\SQL2017\x64\SetupARP.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5063760\GDR\x64\fixsqlregistrykey_x64.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5063760\GDR\x64\fixsqlregistrykey_x86.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5063760\GDR\x64\landingpage.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5063760\GDR\x64\scenarioengine.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5065224\GDR\x64\fixsqlregistrykey_x64.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5065224\GDR\x64\fixsqlregistrykey_x86.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5065224\GDR\x64\landingpage.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Setup Bootstrap\Update Cache\KB5065224\GDR\x64\scenarioengine.exe Net4Runtimes: 4.0 C:\Program Files\Microsoft SQL Server\140\Tools\Binn\SqlLogShip.exe Net4Runtimes: 4.0 C:\Program Files (x86)\Microsoft SQL Server\140\Tools\Binn\SQLPS.exe Net4Runtimes: 4.0 C:\Users\montford.backup\AppData\Local\Temp\MSSQL_BKUPEXEC64\x64\FIXSQLREGISTRYKEY_X64.EXE Net4Runtimes: 4.0 C:\Users\montford.backup\AppData\Local\Temp\MSSQL_BKUPEXEC64\x64\FIXSQLREGISTRYKEY_X86.EXE Net4Runtimes: 4.0 C:\Users\montford.backup\AppData\Local\Temp\MSSQL_BKUPEXEC64\x64\LANDINGPAGE.EXE Net4Runtimes: 4.0 C:\Users\montford.backup\AppData\Local\Temp\MSSQL_BKUPEXEC64\x64\SCENARIOENGINE.EXE Net4Runtimes: 4.0
Source: _Reviewed/MONT-BE-002/Checklist/MONT-BE-002_DotNET4_V2R7_20251023-143746.ckl
Scan Date: 2026-01-14T12:57:39.853926
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-AP-002 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2507.5 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 10/23/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: _Reviewed/MONT-AP-002/Checklist/MONT-AP-002_DotNET4_V2R7_20251023-144010.ckl
Scan Date: 2026-01-14T12:57:42.156893
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-SW-89108 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2510.0 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: MONT-SW-89108_DotNET4_V2R7_20251217-202821.ckl
Scan Date: 2026-03-04T15:25:15.828600
Technology Area: Windows Operating System
|
||||||||
| V-225236 | CAT II | MONT-SW-89134 | Microsoft DotNet Framework 4.0 Security ... | Software utilizing .Net 4.0 must be identified and... | - | |||
Check TextThis requirement does not apply to the "caspol.exe" assembly or other assemblies provided with the Windows OS or the Windows Secure Host Baseline (SHB). Ask the system administrator to provide documentation that identifies: - Each .Net 4.0 application run on the system. - The .Net runtime host that invokes the application. - The security measures employed to control application access to system resources or user access to application. For additional insight run: tasklist /fi "modules eq mscoree.dll" If all .Net applications, runtime hosts and security protections have been documented or if there are no .Net 4.0 applications existing on the system, this is not a finding. If there is no documentation that identifies the existence of .NET 4.0 applications or the lack thereof, this is a finding. If the runtime hosts have not been identified, this is a finding. If the security protections have not been identified, this is a finding. Fix TextDocument the existence of all .Net 4.0 applications that are not provided by the host Windows OS or the Windows Secure Host Baseline (SHB). Document the corresponding runtime hosts that are used to invoke the applications. Document the applications security control requirements (restricting application access to resources or user access to the application). Finding DetailsEvaluate-STIG 1.2510.0 (Scan-NETFramework4_Checks) found this to be NOT A FINDING on 12/17/2025 ResultHash: 4E9D9F9778F6BF1402126A5E6E14400D9AF77B9C ~~~~~ No applications found requiring .NET 4.0 specifically.
Source: MONT-SW-89134_DotNET4_V2R7_20251217-201000.ckl
Scan Date: 2026-03-04T15:25:41.864254
Technology Area: Windows Operating System
|
||||||||