Log in Start free

Vulnerability · Published Jul 8, 2025 · Assigned by HeroDevs

CVE-2025-7326EOL ASP.NET Core Elevation of Privilege Vulnerability

High 7.0

In plain English

A high-severity security flaw in ASP.NET Core 6.0 from Microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

Affected products (as reported)

VendorProductVersions
Microsoft ASP.NET Core 6.0 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.Identity >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.win-arm >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.win-arm64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.win-x64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.win-x86 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.linux-arm >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.linux-arm64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.linux-musl-arm >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.linux-musl-x64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.linux-x64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.osx-arm64 >=6.0.0 – through 6.0.36
Microsoft Microsoft.AspNetCore.App.Runtime.osx-x64 >=6.0.0 – through 6.0.36

Weakness: CWE-1390 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References