MSRC-CVE-2026-47303 — ASP.NET Core Elevation of Privilege Vulnerability

Summary

Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Security updates
10.0.10 — https://support.microsoft.com/kb/5104034
8.0.29 — https://support.microsoft.com/kb/5104032
9.0.18 — https://support.microsoft.com/kb/5104033
17.12.22 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
18.7.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes

Vulnerabilities 1

High 8.8

CVE-2026-47303

ASP.NET Core Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Visual Studio 2022 version 17.14 .NET 9.0 runtime .NET 10.0 runtime Ubuntu Alpine NuGet

Jul 14, 2026

Revision history

2026-08-07 #2
Acknowledgement Updated
2026-07-14 #1
Information published.

References

CVE-2026-47303 ASP.NET Core Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss