EUVD-2026-73722
GHSA-44g5-m8vm-448v
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-reachable with no attacker privileges; user interaction required to trigger cross-origin request; confidentiality-only impact with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Origin validation error (CWE-346) in Microsoft .NET enables network-based information disclosure where an unauthenticated remote attacker can read sensitive data from a .NET application by exploiting improper validation of request origins. Affected are multiple active .NET release trains (8.0, 9.0, 10.0, 11.0 RC1) and Microsoft Visual Studio 2022 and 2026 where bundled .NET runtimes are included. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User interaction is required: the victim must visit an attacker-controlled web page or be induced to trigger a cross-origin HTTP request targeting the vulnerable .NET application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a realistic risk profile: network-reachable, no attacker privileges required, but contingent on victim user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched releases provided by Microsoft: .NET 8.0.130 or 8.0.424, .NET 9.0.120 or 9.0.317, .NET 10.0.111 or 10.0.400, .NET 11.0 RC1, Visual Studio 2022 17.14.40, or Visual Studio 2026 18.9.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today