EUVD-2026-44396
GHSA-qvw7-jm5c-6hqw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed .NET service
-
DeliverySend crafted request to protected endpoint
-
ExploitTrigger incorrect authorization check
-
ExecutionBypass security control
-
ImpactAccess restricted function or data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability - remote unauthenticated exploitation is possible against affected .NET services with no user interaction. The practical limiting factors are that the target application must actually use and rely on the specific .NET authorization/security feature that is bypassed (the advisory does not name the exact control in the available data), the service must be network-reachable to the attacker, and it must be running an unpatched .NET 8.0, 9.0, or 10.0 build. Confidentiality exposure is limited (C:L) while the main consequence is an integrity/authorization bypass (I:H). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, base 8.2) describes a genuinely low-barrier network attack: no authentication, no user interaction, and low attack complexity, with the primary damage being integrity (I:H) - consistent with bypassing an authorization/security control - plus limited confidentiality exposure (C:L) and no availability impact. Against that, the real-world urgency signals are muted: there is no public exploit identified at time of analysis, no EPSS score was provided, and the CVE is not in CISA KEV, so there is no evidence of active or automated exploitation yet. The practical priority therefore hinges on exposure - internet-facing .NET services that depend on the affected authorization feature should treat this as high priority given the trivial exploitability profile, while the absence of a known exploit and EPSS data means the current threat is potential rather than demonstrated. Note that 'security feature bypass' is generic and the exact bypassed control is not detailed in the available data, so confirm applicability against the Microsoft advisory before assuming impact. |
| Exploit ScenarioDerived | An attacker with only network access sends a crafted request to an internet-facing service running an affected .NET version, exploiting the incorrect authorization check to reach functionality or data that the security control was meant to protect. Because no authentication or user interaction is required and complexity is low, the request can succeed against a default-configured target; no public exploit is identified at time of analysis, so this remains a plausible but not yet demonstrated attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumvent an authorization control over the network due to incorrect authorization logic (CWE-863). Rated CVSS 8.2, the flaw carries a high integrity impact and requires no privileges or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Microsoft has released a patch, and the affected surface also includes Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) tooling that bundle the runtime.
RemediationAI
Patch available per vendor advisory - apply the Microsoft updates for the affected .NET runtime/SDK (8.0, 9.0, or 10.0) and, where applicable, update Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7) to the fixed servicing releases, following the exact fixed versions listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528. For self-contained or containerized apps, rebuild and redeploy against the patched runtime since they do not pick up machine-wide .NET updates automatically. As interim compensating controls until patching, restrict network reachability of affected services by placing them behind an authenticated gateway or network ACLs so the AV:N precondition is harder to meet, and increase logging and monitoring on the authorization-sensitive endpoints to detect abuse; these controls reduce exposure but do not close the underlying authorization flaw, so they are stopgaps rather than fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
.NET is Microsoft's cross-platform managed application runtime and framework used to build and host web APIs, services, and desktop/cloud applications; the affected CPEs specifically identify .NET 8.0, 9.0, and 10.0 alongside the Visual Studio 2022/2026 development environments that ship these SDKs. The root cause is CWE-863 (Incorrect Authorization): an authorization decision is evaluated incorrectly, so a request that should be denied is instead permitted. Because this class of bug lives in the framework's own security-enforcement path rather than in a single application, any service relying on the affected .NET authorization primitive can inherit the weakness, which is why Microsoft classifies it as a network-reachable security feature bypass.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-reachable authorization bypass needing no auth or interaction (AV:N/AC:L/PR:N/UI:N); primary effect is an integrity/security-control bypass (I:H) with limited data exposure (C:L) and no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
Executive ViewAI
Microsoft .NET versions 8.0, 9.0, and 10.0 contain a critical authorization bypass vulnerability (CVE-2026-50528) that allows remote, unauthenticated attackers to circumvent security controls and potentially access or modify protected data. Organizations running affected .NET runtimes and bundled Visual Studio instances (2022 versions 17.12/17.14 and 2026 version 18.7) face elevated risk of unauthorized access to sensitive systems. Vendor-released patch is available and must be deployed without delay.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB