CVE-2025-7326
EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
CVE-2025-7326- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1390
- Updated
- 2026-11-02
EUVDEUVD-2025-20507
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
EUVD-2025-20507- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-jqfh-6jjg-67xg
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges...
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
GHSA-jqfh-6jjg-67xg- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1390
- Updated
- 2026-11-02
NVD
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
CVE-2025-7326- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-1390
- Updated
- 2026-11-02
OSVBIT-aspnet-core-2025-7326 No score
EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
BIT-aspnet-core-2025-7326- Updated
- 2026-11-02
OSVBIT-dotnet-2025-7326 No score
EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
BIT-dotnet-2025-7326- Updated
- 2026-11-02
OSVBIT-dotnet-sdk-2025-7326 No score
EOL ASP.NET Core Elevation of Privilege Vulnerability
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
- Record
BIT-dotnet-sdk-2025-7326- Updated
- 2026-11-02
Affected products
- microsoft asp.net core
- microsoft asp.net core 6.0
- microsoft microsoft.aspnetcore.app.runtime.linux-arm
- microsoft microsoft.aspnetcore.app.runtime.linux-arm64
- microsoft microsoft.aspnetcore.app.runtime.linux-musl-arm
- microsoft microsoft.aspnetcore.app.runtime.linux-musl-arm64
- microsoft microsoft.aspnetcore.app.runtime.linux-musl-x64
- microsoft microsoft.aspnetcore.app.runtime.linux-x64
- microsoft microsoft.aspnetcore.app.runtime.osx-arm64
- microsoft microsoft.aspnetcore.app.runtime.osx-x64
- microsoft microsoft.aspnetcore.app.runtime.win-arm
- microsoft microsoft.aspnetcore.app.runtime.win-arm64
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aspnet-coreBitnami |
6.0.0 up to 8.0.1 | 8.0.1 |
dotnetBitnami |
6.0.0 up to 8.0.1 | 8.0.1 |
dotnet-sdkBitnami |
6.0.0 up to 6.0.418 | 6.0.418 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-7326 is a high vulnerability (CVSS 7.0) in Microsoft Asp.net Core, published July 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.71%, the 53rd percentile. Fixed in aspnet-core 8.0.1.
References
cve.org/CVERecord?id=CVE-2025-24070
msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
herodevs.com/vulnerability-directory/cve-2025-7326
nvd.nist.gov/vuln/detail/CVE-2025-7326
github.com/advisories/GHSA-jqfh-6jjg-67xg