7.0
High
CVE-2025-7326 Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network
Description
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ASP.NET Core 6.0 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.Identity 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.win-arm 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.win-arm64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.win-x64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.win-x86 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.linux-arm 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.linux-arm64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm 6.0 | 6.0.0 → latest | No fix stated |
Show the 5 other branches Hide the 5 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.linux-musl-x64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.linux-x64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.osx-arm64 6.0 | 6.0.0 → latest | No fix stated |
| Microsoft.AspNetCore.App.Runtime.osx-x64 6.0 | 6.0.0 → latest | No fix stated |
References
- ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability www.cve.org
- msrc.microsoft.com msrc.microsoft.com
- www.herodevs.com www.herodevs.com
Timeline
- Published
- Last modified