What is the CVSS score of CVE-2026-47302?

CVE-2026-47302 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.8%.

Microsoft Net Framework 3 5 CVE-2026-47302

Q: Which versions of Microsoft Net Framework 3 5 are affected by CVE-2026-47302?

A high-severity denial-of-service vulnerability in Microsoft .NET and .NET Framework allows unauthenticated remote attackers to exhaust server resources, risking service disruption across affected…. A patch is available.

Q: How to fix or mitigate CVE-2026-47302?

Within 24 hours, identify all systems running Microsoft .NET (8.0, 9.0, 10.0) or .NET Framework (3.5-4.8.1) and document their business criticality and network exposure; prioritize internet-facing systems. Within 7 days, retrieve the security patch from Microsoft Security Response Center (MSRC) and deploy to all development and test environments first, validating application compatibility. Within 30 days, complete patch rollout to all production systems running affected versions, prioritizing critical services, and verify installation success through MSRC patch tracking or Windows Update logs.

EUVD-2026-44353 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-cvvh-rhrc-wg4q

Denial Of Service Microsoft Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.5

CVSS 3.1 · Vendor: microsoft

Temporal: 6.5

View

Vulnerability Assessment

Weakness

CWE

CWE-770

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V2 - Validation and Business Logic Resource allocation limits

MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) and the legacy .NET Framework (3.5 through 4.8.1) allows a remote unauthenticated attacker to exhaust server resources over the network, causing availability loss. The flaw stems from missing limits or throttling on resource allocation (CWE-770), and Microsoft has released a patch via MSRC. There is no public exploit identified at time of analysis, and EPSS/KEV data were not supplied, so this appears to be a proactively patched issue rather than one under active exploitation.

Affected VersionsENISA

.NET 9.0 9.0.0 <9.0.18

Microsoft Visual Studio 2026 version 18.7 18.0 <18.7.4

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.36

Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Microsoft .NET Framework 4.8 4.8.0 <4.8.4803.0

.NET 10.0 10.0.0 <10.0.6

Microsoft .NET Framework 3.5 AND 4.8 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

Microsoft .NET Framework 3.5 3.5.0 <2.0.50727.8983 & 3.0.30729.8978

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.22

.NET 8.0 8.0.0 <8.0.29

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 <4.7.4143.0

Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

Affected Packages

nuget microsoft.netcore.app.runtime.linux-arm fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-musl-arm fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-musl-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-musl-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.linux-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.osx-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.osx-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.win-arm fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.win-arm64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.win-x64 fix: 8.0.29, 9.0.18, 10.0.10

nuget microsoft.netcore.app.runtime.win-x86 fix: 8.0.29, 9.0.18, 10.0.10

nuget system.security.cryptography.xml fix: 8.0.4, 9.0.18, 10.0.10

euvd microsoft_net_framework_3_5_3_5_0_2_0_50727_8983 no fix

euvd microsoft_net_framework_3_5_and_4_7_2_4_7_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_3_5_and_4_8_1_4_8_1_2_0_50727_9182_3_0_30729_9168 no fix

euvd microsoft_net_framework_3_5_and_4_8_4_8_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_4_6_2_4_7_4_7_1_4_7_2 fix: 4.7.4143.0

euvd microsoft_net_framework_4_8 fix: 4.8.4803.0

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.22

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.36

euvd microsoft_visual_studio_2026_version_18_7 fix: 18.7.4

euvd net_10_0 fix: 10.0.6

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 25 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Microsoft Net Framework 3 5 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD HIGH

CIRCL (temporal) 6.5 MEDIUM

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

A high-severity denial-of-service vulnerability in Microsoft .NET and .NET Framework allows unauthenticated remote attackers to exhaust server resources, risking service disruption across affected infrastructure. The flaw impacts .NET versions 8.0, 9.0, 10.0 and legacy Framework 3.5 through 4.8.1, affecting any organization running these widely-deployed platforms. Although Microsoft has released a patch, unpatched systems face immediate risk from network-based availability attacks.

Recommended Action

Within 24 hours, identify all systems running Microsoft .NET (8.0, 9.0, 10.0) or .NET Framework (3.5-4.8.1) and document their business criticality and network exposure; prioritize internet-facing systems. Within 7 days, retrieve the security patch from Microsoft Security Response Center (MSRC) and deploy to all development and test environments first, validating application compatibility. Within 30 days, complete patch rollout to all production systems running affected versions, prioritizing critical services, and verify installation success through MSRC patch tracking or Windows Update logs.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.8%

Top 47% exploitable

Threat Intel

1 sources

Vendor Action

See Below

Required. The vulnerability documented by this CVE requires customer action to resolve.

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

8 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.