EUVD-2026-44354
GHSA-2p3q-h3hg-jcqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryIdentify assumed-immutable identity data
-
ExploitTamper with token/claim value
-
ExecutionResubmit to bypass authentication
-
ImpactElevate to higher privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Data mutability checks in auth
|
| Exploitation Conditions | Exploitation requires the attacker to already possess valid low-privileged authenticated access to the target ASP.NET Core application, reflected by CVSS PR:L - this is not an unauthenticated attack. The application must run on a vulnerable ASP.NET Core runtime from .NET 8.0, 9.0, or 10.0 and rely on the affected framework path that treats certain identity/authentication data as immutable. No user interaction is needed (UI:N) and the attack is over the network (AV:N) with low complexity (AC:L). The principal limiting factor is the need for a pre-existing account/foothold; a fully anonymous outsider cannot trigger the bypass without first authenticating. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High) indicates a network-reachable, low-complexity attack requiring the attacker to already hold low-level privileges (PR:L - an authenticated but unprivileged account) with no user interaction, yielding high confidentiality, integrity, and availability impact in an unchanged scope. This is a credible priority for internet-facing or multi-tenant ASP.NET Core applications because elevation from a normal user to a higher-privileged role is exactly what a low-friction bypass enables. However, no EPSS score is provided, the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation is currently unproven - the priority is driven by severe impact plus a low barrier once a foothold exists, not by evidence of active attacks. The PR:L requirement for pre-existing authenticated access is the main limiting factor and distinguishes this from a fully unauthenticated, worm-class internet threat. |
| Exploit ScenarioDerived | An attacker holding a low-privilege account on an ASP.NET Core application logs in normally, then manipulates an identity artifact (such as a claim or token value) that the framework assumes cannot be changed, and resubmits it to be accepted as a higher-privileged user. Because the attack is network-based and low-complexity with no user interaction, the request can be automated once the tamperable field is identified. No public POC is referenced in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged network attacker bypass authentication controls by tampering with data the framework wrongly assumes to be immutable (CWE-302). Microsoft reported and patched the flaw; there is no public exploit identified at time of analysis and it is not on CISA KEV. At CVSS 8.8 with PR:L, an authorized user can escalate to higher privileges over the network.
RemediationAI
Apply the Microsoft-released update for the affected .NET channel - patch available per vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303 - installing the latest servicing release for .NET 8.0, 9.0, or 10.0, and the corresponding Visual Studio 2022 17.12/17.14 or Visual Studio 2026 18.7 update on developer machines and build agents. Exact fixed version numbers are not stated in the provided data, so pull them from the MSRC page rather than assuming. For self-contained or framework-dependent deployments, rebuild and redeploy against the patched runtime and confirm no older ASP.NET Core assemblies remain bundled. Until patching completes, compensating controls should reduce the value of a low-privilege foothold: enforce server-side authorization so privileged actions re-verify identity rather than trusting a single token/claim, rotate and shorten session/identity token lifetimes, and restrict which accounts can reach sensitive endpoints - noting these are partial mitigations that do not close the underlying bypass and may add authentication overhead for legitimate users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 7 packages in nuget, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in the ASP.NET Core web framework that ships as part of the .NET runtime/SDK (Microsoft .NET 8.0, 9.0, and 10.0) and is also serviced through Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7). The root cause class is CWE-302, Authentication Bypass by Assumed-Immutable Data: the framework trusts a piece of data - such as a token, claim, cookie, or identity artifact - as if it cannot be altered after issuance, when an attacker can in fact modify it. Because ASP.NET Core sits directly on the authentication/authorization boundary of web applications, a defect in how it validates supposedly-fixed identity data lets a caller present manipulated but accepted credentials, defeating the trust the application places in the framework.
Know when Net 10 0 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable low-complexity bypass needing a pre-existing low-privilege account (PR:L, no UI), yielding full privilege elevation with high C/I/A in unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
ASP.NET Core on .NET 8.0, 9.0, and 10.0 contains a privilege escalation vulnerability allowing low-privileged authenticated users to gain higher access levels over the network. Any organization running these framework versions faces direct risk of insider privilege abuse; attackers with minimal legitimate access can compromise system integrity and access restricted data. Microsoft has released a patch and remediation should be prioritized to prevent exploitation.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Security feature bypass in Microsoft .NET (versions 8.0, 9.0, and 10.0) lets a remote, unauthenticated attacker circumve
Infinite loop denial-of-service vulnerability in Microsoft .NET Framework (3.5 through 4.8.1), .NET 8.0, 9.0, and 10.0 a
Network denial of service in Microsoft .NET 8.0, 9.0, and 10.0 (and the corresponding Visual Studio 2022/2026 tooling) a
Network-based denial of service in Microsoft .NET 8.0, 9.0, and 10.0 allows an unauthenticated remote attacker to exhaus
Denial-of-service condition in Microsoft .NET Framework 8.0, 9.0, and 10.0 allows unauthenticated remote attackers to ex
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted ne
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an atta
Local privilege escalation in Microsoft .NET Framework (versions 3.5 through 10.0) and Visual Studio 2017 occurs through
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to m
Privilege elevation in ASP.NET Core (bundled with .NET 8.0, 9.0, and 10.0) lets an already-authenticated, low-privileged
Absolute path traversal in Microsoft .NET Core (Windows runtime, versions 8.0 through 10.0) enables a network-accessible
Denial of service in Microsoft .NET (versions 8.0, 9.0, and 10.0) allows a remote, unauthenticated attacker to crash or
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Liberty Linux 10 | Fixed |
| SUSE Liberty Linux 8 | Fixed |
| SUSE Liberty Linux 9 | Fixed |
Exploit-DB