EUVD-2026-44407
GHSA-74jp-vm22-8q8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged application credentials
-
DeliveryAuthenticate and send crafted network request to .NET endpoint
-
ExploitTrigger improper encoding or escaping in framework output pipeline
-
ExecutionInject spoofed content into malformed response
-
ImpactDownstream service or client interprets forged output as trusted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding for downstream
|
| Exploitation Conditions | Exploitation requires the attacker to hold at least low-privileged access to the target .NET application, as confirmed by the CVSS PR:L metric - unauthenticated exploitation is not supported by available data. The attack is network-accessible (AV:N), requires no user interaction (UI:N), and involves low complexity (AC:L), meaning no race conditions or specialized environment configuration are needed beyond obtaining credentials or a valid session. Scope is unchanged (S:U), so impact is contained to the integrity of the vulnerable system's output and does not propagate directly to other systems. Limiting factors are: the authentication prerequisite (PR:L eliminates fully anonymous exploitation), the SSVC non-automatable classification (mass scanning campaigns are constrained), and the high integrity but zero confidentiality and availability impact, which limits the damage model to spoofing scenarios rather than data theft or service disruption. The specific .NET output path or API that triggers the improper encoding is not identified in NVD or MSRC data beyond what the public POC demonstrates. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) scores 6.5, reflecting network-accessible exploitation at low privilege with high integrity impact and no confidentiality or availability consequence - consistent with a spoofing attack that manipulates output rather than exfiltrating data. EPSS at 0.41% (34th percentile) is notably low for a vulnerability with a public POC, and CISA SSVC classifies exploitation as 'none,' technical impact as 'partial,' and the attack as non-automatable - signaling that mass exploitation is not currently occurring and is constrained by design. The public GitHub gist POC lowers the barrier for targeted opportunistic attacks but does not imply automated campaign activity. The low EPSS despite POC availability suggests the flaw may require specific application patterns, output contexts, or trust relationships to be reliably exploitable in practice. Overall priority is moderate - patch within normal cycles, with urgency elevated for internet-facing .NET applications that process attacker-controlled input and produce output consumed by privileged downstream systems. |
| Exploit ScenarioDerived | A low-privileged attacker with authenticated access to a .NET web application sends a crafted request that causes the .NET runtime to improperly encode or escape special characters in its output. The resulting malformed response allows the attacker to inject spoofed content - such as fabricated HTTP headers, forged identity assertions, or manipulated response data - that a downstream service or user client interprets as legitimate and trusted. A proof-of-concept demonstrating this technique is publicly available at https://gist.github.com/alon710/af1ea10f18a378d81f14e813f0229c10. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to manipulate encoded output, enabling content or identity spoofing with high integrity impact. Affected products span three active .NET generations plus Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7), creating a broad enterprise attack surface. A publicly available proof-of-concept exploit exists on GitHub; however, CISA SSVC reports exploitation status as none and EPSS sits at 0.41% (34th percentile), suggesting opportunistic rather than widespread active threat activity at time of analysis.
RemediationAI
The primary fix is to upgrade to vendor-released patched versions: .NET 8.0 to 8.0.29 or later, .NET 9.0 to 9.0.18 or later, and .NET 10.0 to 10.0.6 or later. For Visual Studio users, upgrade to Visual Studio 2022 17.12.22 or later (17.12 channel), 17.14.36 or later (17.14 channel), or Visual Studio 2026 18.7.4 or later (18.7 channel). Full patch guidance is published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50659; Ubuntu package updates are documented at https://ubuntu.com/security/notices/USN-8553-1. If immediate patching is not operationally feasible, compensating controls include restricting network access to .NET application endpoints to known-trusted principals to reduce the exploitable low-privileged attacker pool - note this introduces access-control overhead and does not eliminate the flaw. Additionally, audit application-layer output encoding for any custom escaping logic that may compound this framework-level defect. No patch-free mitigation fully addresses the root encoding flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 18 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-116 (Improper Encoding or Escaping of Output), a class of flaw where a framework fails to properly sanitize special characters when generating network output - such as HTTP headers, HTML, XML, or JSON - allowing injected content to be misinterpreted by downstream consumers or services. CPE data confirms three distinct .NET runtime generations are affected: cpe:2.3:a:microsoft:.net_8.0, cpe:2.3:a:microsoft:.net_9.0, and cpe:2.3:a:microsoft:.net_10.0, as well as the Microsoft Visual Studio 2022 IDE (channels 17.12 and 17.14) and Visual Studio 2026 (channel 18.7). The flaw resides in .NET's output encoding subsystem; any application relying on the framework's built-in escaping utilities to construct network-facing responses is potentially affected. The specific API surface (e.g., HtmlEncoder, HttpUtility, or header encoding routines) is not disclosed in the available NVD or MSRC data.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-exploitable spoofing requires low-privilege credentials (PR:L); high integrity impact from output injection; no confidentiality or availability impact aligns with pure spoofing behavior.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB