What is the CVSS score of EUVD-2026-44398?

EUVD-2026-44398 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

How to fix or mitigate EUVD-2026-44398?

Within 24 hours, inventory all .NET deployments to identify affected versions (8.0, 9.0, 10.0, and Framework 3.5-4.8.1) and prioritize network-facing applications. Within 7 days, obtain the vendor patch from Microsoft, test it in a non-production environment that mirrors production, and begin staged rollout to production systems. Within 30 days, complete patching across all affected .NET instances and validate remediation.

.NET EUVD-2026-44398

Q: Which versions of .NET are affected by EUVD-2026-44398?

A remotely exploitable denial-of-service vulnerability in Microsoft .NET (versions 8.0-10.0) and .NET Framework (3.5-4.8.1) allows unauthenticated attackers to exhaust server resources and crash…. A patch is available.

| CVE-2026-50648 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-14 microsoft

GHSA-23rf-6693-g89p

Denial Of Service Microsoft Microsoft Net Framework 3 5 Microsoft Net Framework 3 5 And 4 7 2 Microsoft Net Framework 3 5 And 4 8 Microsoft Net Framework 3 5 And 4 8 1 Microsoft Net Framework 4 6 2 4 7 4 7 1 4 7 2 Microsoft Net Framework 4 8 Net 10 0 Net 8 0 Net 9 0 Microsoft Visual Studio 2022 Version 17 12 Microsoft Visual Studio 2022 Version 17 14 Microsoft Visual Studio 2026 Version 18 7

7.5

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach network-facing .NET service
Delivery

Send crafted request stream
Exploit

Trigger unbounded resource allocation
Execution

Exhaust memory/CPU/threads
Impact

Service becomes unavailable

Vulnerability Assessment

Weakness	CWE CWE-770 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource allocation limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of network-facing Microsoft .NET and .NET Framework applications, per AV:N/AC:L/PR:N/UI:N. The practical limiting factor is that the target must expose a vulnerable .NET-based network service to the attacker; hosts not reachable over the network, or protected by upstream rate-limiting or WAF controls, face reduced risk. The exact protocol or feature that triggers the unbounded allocation is not specified in the description, so defenders should confirm which endpoints are affected via the Microsoft advisory.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes a fully remote, unauthenticated, low-complexity attack with no user interaction and high availability impact but zero confidentiality or integrity impact - a classic network DoS. This is a genuine patch-priority issue for internet-facing .NET services because exploitation is easy and pre-authentication, but the ceiling is limited to service disruption, not code execution or data theft. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so real-world exploitation likelihood cannot be quantified from the input; treat the network-DoS risk as credible but not confirmed as actively targeted. The specific network protocol or feature that triggers the unbounded allocation is not described, which limits precise exposure assessment - verify affected endpoints with the Microsoft advisory.
Exploit ScenarioDerived	An attacker with only network access to an exposed .NET application sends a stream of crafted requests that each cause the runtime to allocate memory, threads, or connections without limit, driving the host to resource exhaustion. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the requests can be scripted and repeated to keep the service unavailable. No public exploit is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Denial of service in Microsoft .NET (including .NET 8.0/9.0/10.0 and .NET Framework 3.5 through 4.8.1) lets a remote unauthenticated attacker exhaust server resources by sending crafted network traffic that triggers unbounded resource allocation. Rated CVSS 7.5 with availability-only impact, it affects default configurations of network-facing .NET applications; no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security updates referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50648 for each affected .NET and .NET Framework channel via Windows Update or the .NET update packages, and update affected Visual Studio 2022/2026 installations to the latest servicing release. No exact fixed version string is provided in the input, so consult the MSRC update guide for the precise build per platform. Where immediate patching is not possible, reduce exposure by restricting network reachability of the affected .NET service (firewall or allowlist to trusted clients), placing it behind a reverse proxy or WAF that enforces request-size and rate limits, and applying application-level connection and request throttling - with the trade-off that these controls mitigate but do not eliminate the underlying unbounded-allocation defect and may throttle legitimate high-volume clients.

Affected VersionsENISA

Microsoft .NET Framework 3.5 AND 4.7.2 4.7.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.7.4143.0

.NET 10.0 10.0.0 <10.0.6

.NET 8.0 8.0.0 <8.0.29

.NET 9.0 9.0.0 <9.0.18

Microsoft .NET Framework 3.5 AND 4.8 4.8.0 <2.0.50727.9069 & 3.0.30729.9067 & 4.8.4803.0

Microsoft .NET Framework 3.5 3.5.0 <2.0.50727.8983 & 3.0.30729.8978

Microsoft .NET Framework 3.5 AND 4.8.1 4.8.1 <2.0.50727.9182 & 3.0.30729.9168 & 4.8.9339.0

Microsoft .NET Framework 4.8 4.8.0 <4.8.4803.0

Microsoft Visual Studio 2026 version 18.7 18.0 <18.7.4

Microsoft Visual Studio 2022 version 17.14 17.14.0 <17.14.36

Microsoft Visual Studio 2022 version 17.12 17.12.0 <17.12.22

Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 4.7.0 <4.7.4143.0

Affected Packages

nuget system.security.cryptography.xml fix: 8.0.4, 9.0.18, 10.0.10

euvd microsoft_net_framework_3_5_3_5_0_2_0_50727_8983 no fix

euvd microsoft_net_framework_3_5_and_4_7_2_4_7_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_3_5_and_4_8_1_4_8_1_2_0_50727_9182_3_0_30729_9168 no fix

euvd microsoft_net_framework_3_5_and_4_8_4_8_0_2_0_50727_9069_3_0_30729_9067 no fix

euvd microsoft_net_framework_4_6_2_4_7_4_7_1_4_7_2 fix: 4.7.4143.0

euvd microsoft_net_framework_4_8 fix: 4.8.4803.0

euvd microsoft_visual_studio_2022_version_17_12 fix: 17.12.22

euvd microsoft_visual_studio_2022_version_17_14 fix: 17.14.36

euvd microsoft_visual_studio_2026_version_18_7 fix: 18.7.4

euvd net_10_0 fix: 10.0.6

euvd net_8_0 fix: 8.0.29

euvd net_9_0 fix: 9.0.18

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 13 packages in nuget, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw is a CWE-770 (Allocation of Resources Without Limits or Throttling) weakness in Microsoft's .NET runtime and the legacy .NET Framework. Affected components span the modern cross-platform runtime (.NET 8.0, 9.0, 10.0) and the Windows-only .NET Framework versions 3.5, 4.6.2, 4.7.x, 4.8, and 4.8.1 per the CPE data, plus tooling shipped in Visual Studio 2022 (17.12/17.14) and Visual Studio 2026 18.7. CWE-770 flaws typically arise when a request handler or parser allocates memory, threads, connections, or buffers proportional to attacker-controlled input without enforcing a cap, so a small malicious request can consume disproportionate CPU or memory.

Know when Microsoft Net Framework 3 5 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ENISA EUVD HIGH

vuln.today AI 7.5 HIGH

Remote, unauthenticated, low-complexity network DoS with no user interaction; availability-only impact (A:H) and no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.

Executive ViewAI

Why It Matters

A remotely exploitable denial-of-service vulnerability in Microsoft .NET (versions 8.0-10.0) and .NET Framework (3.5-4.8.1) allows unauthenticated attackers to exhaust server resources and crash production applications. Network-facing .NET deployments face immediate risk of service outages; remediation is critical for any organization depending on these runtimes for customer-facing or business-critical services.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 54% exploitable

Prevalence

Ubiquitous

.NET and .NET Framework runtimes ship on nearly all Windows enterprise environments

Threat Intel

1 sources

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

8 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL GHSA MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.