EUVD-2026-44342
GHSA-8prm-248r-h957
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable, low-complexity elevation from an existing low-privilege account (PR:L, no UI), yielding full high C/I/A impact within the same authorization scope (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker gain higher privileges by abusing a flawed authentication algorithm implementation (CWE-303). Microsoft reported the flaw and has released a patch; there is no public exploit identified at time of analysis and it is not on the CISA KEV. The 8.8 CVSS reflects high confidentiality, integrity, and availability impact reachable over the network with only low prior privileges.
Technical ContextAI
The affected component is the ASP.NET Core web framework shipping in the .NET 8.0, 9.0, and 10.0 runtimes (per CPE cpe:2.3:a:microsoft:.net_8.0/9.0/10.0), with tooling exposure in Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7). The root cause is classified as CWE-303, Incorrect Implementation of an Authentication Algorithm - the authentication/authorization logic evaluates credentials or claims incorrectly, so a request that should be rejected or held at a lower trust level is instead granted elevated rights. This is a logic flaw in the framework's own auth handling rather than a memory-safety or injection bug, meaning any web application built on the vulnerable ASP.NET Core stack that relies on the framework's authentication middleware may inherit the weakness.
RemediationAI
Patch available per vendor advisory: apply the Microsoft/.NET updates for the affected 8.0, 9.0, and 10.0 runtimes and rebuild/redeploy applications against the patched ASP.NET Core packages, and update the affected Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) installations; exact fixed version numbers are not listed in the input and must be taken from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47300. Because this is a framework-level authentication algorithm flaw, self-hosted apps must ship the updated runtime/NuGet packages rather than relying on OS patching alone. As interim compensating controls until patched, restrict and closely monitor access to authenticated endpoints, reduce the number of low-privilege accounts that can reach sensitive functionality, and add server-side authorization checks or a reverse-proxy access policy in front of privileged routes - with the trade-off that these do not fix the underlying algorithm and may break legitimate low-privilege workflows.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today