EUVD-2026-44354
GHSA-2p3q-h3hg-jcqq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable low-complexity bypass needing a pre-existing low-privilege account (PR:L, no UI), yielding full privilege elevation with high C/I/A in unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker bypass authentication controls by tampering with data the framework wrongly assumes to be immutable (CWE-302). Microsoft reported and patched the flaw; there is no public exploit identified at time of analysis and it is not on CISA KEV. At CVSS 8.8 with PR:L, an authorized user can escalate to higher privileges over the network.
Technical ContextAI
The vulnerability lives in the ASP.NET Core web framework that ships as part of the .NET runtime/SDK (Microsoft .NET 8.0, 9.0, and 10.0) and is also serviced through Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7). The root cause class is CWE-302, Authentication Bypass by Assumed-Immutable Data: the framework trusts a piece of data - such as a token, claim, cookie, or identity artifact - as if it cannot be altered after issuance, when an attacker can in fact modify it. Because ASP.NET Core sits directly on the authentication/authorization boundary of web applications, a defect in how it validates supposedly-fixed identity data lets a caller present manipulated but accepted credentials, defeating the trust the application places in the framework.
RemediationAI
Apply the Microsoft-released update for the affected .NET channel - patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303 - installing the latest servicing release for .NET 8.0, 9.0, or 10.0, and the corresponding Visual Studio 2022 17.12/17.14 or Visual Studio 2026 18.7 update on developer machines and build agents. Exact fixed version numbers are not stated in the provided data, so pull them from the MSRC page rather than assuming. For self-contained or framework-dependent deployments, rebuild and redeploy against the patched runtime and confirm no older ASP.NET Core assemblies remain bundled. Until patching completes, compensating controls should reduce the value of a low-privilege foothold: enforce server-side authorization so privileged actions re-verify identity rather than trusting a single token/claim, rotate and shorten session/identity token lifetimes, and restrict which accounts can reach sensitive endpoints - noting these are partial mitigations that do not close the underlying bypass and may add authentication overhead for legitimate users.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today