What is the CVSS score of CVE-2026-47302?

CVE-2026-47302 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Which versions of Microsoft Net Framework 3 5 are affected by CVE-2026-47302?

A high-severity denial-of-service vulnerability in Microsoft .NET and .NET Framework allows unauthenticated remote attackers to exhaust server resources, risking service disruption across affected…. A patch is available.

How to fix or mitigate CVE-2026-47302?

Within 24 hours, identify all systems running Microsoft .NET (8.0, 9.0, 10.0) or .NET Framework (3.5-4.8.1) and document their business criticality and network exposure; prioritize internet-facing systems. Within 7 days, retrieve the security patch from Microsoft Security Response Center (MSRC) and deploy to all development and test environments first, validating application compatibility. Within 30 days, complete patch rollout to all production systems running affected versions, prioritizing critical services, and verify installation success through MSRC patch tracking or Windows Update logs.

Microsoft Net Framework 3 5 CVE-2026-47302

EUVD-2026-44353 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-cvvh-rhrc-wg4q

Denial Of Service Microsoft Red Hat Suse Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

Severity by source

Vendor (microsoft) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 20:10 vuln.today

CVE Published

Jul 14, 2026 - 18:45 nvd

HIGH 7.5

DescriptionCVE.org

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

AnalysisAI

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the legacy .NET Framework (3.5 through 4.8.1) allows a remote unauthenticated attacker to exhaust server resources over the network, causing availability loss. The flaw stems from missing limits or throttling on resource allocation (CWE-770), and Microsoft has released a patch via MSRC. There is no public exploit identified at time of analysis, and EPSS/KEV data were not supplied, so this appears to be a proactively patched issue rather than one under active exploitation.