What is the CVSS score of CVE-2026-47304?

CVE-2026-47304 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Jwt Attack are affected by CVE-2026-47304?

A critical security bypass in Microsoft .NET (Visual Studio 2022 versions 17.12/17.14 and Visual Studio 2026 version 18.7) allows unauthenticated remote attackers to forge authentication tokens and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-47304?

Yes, a public proof-of-concept exploit is available for CVE-2026-47304. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-47304?

Within 24 hours, identify all systems running Visual Studio 2022 versions 17.12, 17.14, or Visual Studio 2026 version 18.7, and audit which deployed .NET applications depend on cryptographic signature verification for JWT or token-based authentication. Within 7 days, apply the vendor-released patch for all affected Visual Studio versions and recompile any affected .NET assemblies with the patched runtime. Within 30 days, complete security validation testing of authentication flows and review access logs for suspicious token-based activity during the exposure window.

Jwt Attack CVE-2026-47304

EUVD-2026-44355 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-07-14 microsoft

GHSA-g8r8-53c2-pm3f

Authentication Bypass Microsoft Red Hat Jwt Attack Suse Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

9.8

CVSS 3.1 · NVD

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.1 HIGH

cvss

SUSE

HIGH

qualitative

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 13:52 vuln.today

cvss_changed

Severity Changed

Jul 24, 2026 - 13:52 NVD

HIGH CRITICAL

CVSS changed

Jul 24, 2026 - 13:52 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 14, 2026 - 20:10 vuln.today

CVE Published

Jul 14, 2026 - 18:45 nvd

HIGH 8.1

DescriptionNVD

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

AnalysisAI

Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets a remote, unauthenticated attacker defeat a cryptographic-signature check over the network — most likely a JWT/token signature verification flaw per the vendor 'Jwt Attack' and 'Authentication Bypass' tags. By forging or tampering with signed data the runtime fails to validate correctly, an attacker can impersonate trusted principals and undermine an authentication or integrity control. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.