EUVD-2026-44342
GHSA-8prm-248r-h957
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryCraft request abusing auth algorithm
-
ExploitBypass privilege checks (CWE-303)
-
ExecutionObtain elevated privileges
-
ImpactAccess or alter protected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication algorithm review
|
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid low-privilege authenticated session or credentials on an ASP.NET Core application that uses the framework's built-in authentication (CVSS PR:L confirms prior low-level authentication is needed, so this is not an unauthenticated attack). The target application must be built on the vulnerable .NET 8.0/9.0/10.0 ASP.NET Core stack and rely on the affected authentication algorithm path. Limiting factors: an attacker with no account cannot exploit it directly, and applications that do not use the affected framework authentication component, or that enforce independent server-side authorization, reduce exposure; no user interaction is required (UI:N) and the vector is fully network-reachable (AV:N/AC:L). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) indicates a low-complexity, network-reachable attack that requires the attacker to already hold some low-privilege authenticated foothold (PR:L) but no user interaction, yielding full high impact to confidentiality, integrity, and availability. No EPSS score, SSVC decision, or KEV entry was provided, and no POC is referenced, so the practical exploitation-probability signals are absent; this reads as a serious-but-not-yet-known-exploited framework flaw rather than a confirmed mass-exploitation event. Note a data conflict: the vulnerability description and CWE-303 point to privilege elevation, yet the vendor Tags label it 'Information Disclosure' - verify the exact impact class against the MSRC advisory. Given ASP.NET Core's very broad deployment footprint, defenders should treat this as a high patch priority even absent EPSS/KEV data, because the low privilege requirement is easily met in multi-tenant or self-service web applications. |
| Exploit ScenarioDerived | An attacker who holds a normal low-privilege account on an ASP.NET Core web application (for example a standard registered user in a multi-tenant portal) sends a crafted authenticated request that the flawed authentication algorithm mis-evaluates, causing the framework to grant elevated privileges. With administrator-level access the attacker then reads other tenants' data and alters or disrupts the application. No public POC is referenced, and the low attack complexity means exploitation would be reliable once the logic flaw is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker gain higher privileges by abusing a flawed authentication algorithm implementation (CWE-303). Microsoft reported the flaw and has released a patch; there is no public exploit identified at time of analysis and it is not on the CISA KEV. The 8.8 CVSS reflects high confidentiality, integrity, and availability impact reachable over the network with only low prior privileges.
RemediationAI
Patch available per vendor advisory: apply the Microsoft/.NET updates for the affected 8.0, 9.0, and 10.0 runtimes and rebuild/redeploy applications against the patched ASP.NET Core packages, and update the affected Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) installations; exact fixed version numbers are not listed in the input and must be taken from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300. Because this is a framework-level authentication algorithm flaw, self-hosted apps must ship the updated runtime/NuGet packages rather than relying on OS patching alone. As interim compensating controls until patched, restrict and closely monitor access to authenticated endpoints, reduce the number of low-privilege accounts that can reach sensitive functionality, and add server-side authorization checks or a reverse-proxy access policy in front of privileged routes - with the trade-off that these do not fix the underlying algorithm and may break legitimate low-privilege workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in microsoft, nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the ASP.NET Core web framework shipping in the .NET 8.0, 9.0, and 10.0 runtimes (per CPE cpe:2.3:a:microsoft:.net_8.0/9.0/10.0), with tooling exposure in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7). The root cause is classified as CWE-303, Incorrect Implementation of an Authentication Algorithm - the authentication/authorization logic evaluates credentials or claims incorrectly, so a request that should be rejected or held at a lower trust level is instead granted elevated rights. This is a logic flaw in the framework's own auth handling rather than a memory-safety or injection bug, meaning any web application built on the vulnerable ASP.NET Core stack that relies on the framework's authentication middleware may inherit the weakness.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity elevation from an existing low-privilege account (PR:L, no UI), yielding full high C/I/A impact within the same authorization scope (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
ASP.NET Core in .NET 8.0, 9.0, and 10.0 contains a network-exploitable privilege escalation vulnerability enabling authenticated users to elevate access and potentially compromise system confidentiality, integrity, and availability. While no public exploit identified at time of analysis, this vulnerability is particularly critical for multi-tenant and role-based access systems where application-level privilege boundaries protect sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB