EUVD-2026-44396
GHSA-qvw7-jm5c-6hqw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-reachable authorization bypass needing no auth or interaction (AV:N/AC:L/PR:N/UI:N); primary effect is an integrity/security-control bypass (I:H) with limited data exposure (C:L) and no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.
AnalysisAI
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumvent an authorization control over the network due to incorrect authorization logic (CWE-863). Rated CVSS 8.2, the flaw carries a high integrity impact and requires no privileges or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Microsoft has released a patch, and the affected surface also includes Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7) tooling that bundle the runtime.
Technical ContextAI
.NET is Microsoft's cross-platform managed application runtime and framework used to build and host web APIs, services, and desktop/cloud applications; the affected CPEs specifically identify .NET 8.0, 9.0, and 10.0 alongside the Visual Studio 2022/2026 development environments that ship these SDKs. The root cause is CWE-863 (Incorrect Authorization): an authorization decision is evaluated incorrectly, so a request that should be denied is instead permitted. Because this class of bug lives in the framework's own security-enforcement path rather than in a single application, any service relying on the affected .NET authorization primitive can inherit the weakness, which is why Microsoft classifies it as a network-reachable security feature bypass.
RemediationAI
Patch available per vendor advisory - apply the Microsoft updates for the affected .NET runtime/SDK (8.0, 9.0, or 10.0) and, where applicable, update Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 (18.7) to the fixed servicing releases, following the exact fixed versions listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50528. For self-contained or containerized apps, rebuild and redeploy against the patched runtime since they do not pick up machine-wide .NET updates automatically. As interim compensating controls until patching, restrict network reachability of affected services by placing them behind an authenticated gateway or network ACLs so the AV:N precondition is harder to meet, and increase logging and monitoring on the authorization-sensitive endpoints to detect abuse; these controls reduce exposure but do not close the underlying authorization flaw, so they are stopgaps rather than fixes.
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today