Authentication Bypass Vulnerability in ASP.NET Core by Microsoft
CVE-2026-47303

8.8HIGH

Key Information:

Vendor

Microsoft
Status
.net 10.0
.net 8.0
.net 9.0
Microsoft Visual Studio 2022 Version 17.12
Vendor
CVE Published:
14 July 2026

What is CVE-2026-47303?

An authentication bypass vulnerability exists in ASP.NET Core due to the mishandling of immutable data. An attacker with valid credentials can exploit this flaw to elevate their privileges, potentially allowing unauthorized access to sensitive functions and resources over the network. It is crucial to address this vulnerability to maintain the security integrity of affected applications.

Affected Version(s)

.NET 10.0 10.0.0 < 10.0.6

.NET 8.0 8.0.0 < 8.0.29

.NET 9.0 9.0.0 < 9.0.18

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.