{"id":"CVE-2025-7326","aliases":["BIT-aspnet-core-2025-7326","BIT-dotnet-2025-7326","BIT-dotnet-sdk-2025-7326","EUVD-2025-20507","GHSA-jqfh-6jjg-67xg"],"status":"published","title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00711,"percentile":0.53904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1390"],"published":"2025-07-08T14:31:45Z","modified":"2026-10-22T09:00:02Z","fixes":[{"ecosystem":"Bitnami","package":"aspnet-core","fixed_in":["8.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet","fixed_in":["8.0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"dotnet-sdk","fixed_in":["6.0.418"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"aspnet-core","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"8.0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"dotnet-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.0.418"}]}]}],"products":[{"vendor":"microsoft","product":"asp.net core"},{"vendor":"microsoft","product":"asp.net core 6.0"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.linux-arm"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.linux-arm64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.linux-musl-arm"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.linux-musl-arm64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.linux-musl-x64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.linux-x64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.osx-arm64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.osx-x64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.win-arm"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.win-arm64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.win-x64"},{"vendor":"microsoft","product":"microsoft.aspnetcore.app.runtime.win-x86"},{"vendor":"microsoft","product":"microsoft.aspnetcore.identity"}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24070","tags":["related","web"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070","tags":["vendor-advisory","web"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-7326","tags":["web"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-7326?nes-for-.net","tags":["exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7326","tags":["web"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-24070"},{"url":"https://github.com/advisories/GHSA-jqfh-6jjg-67xg"}],"sources":{"cve":[{"id":"CVE-2025-7326","title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2025-07-08T14:31:45.633Z","modified":"2025-07-22T15:20:41.162Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2025-20507","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2025-07-08T14:31:45Z","modified":"2025-07-22T15:20:41Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:05.744165Z"}],"ghsa":[{"id":"GHSA-jqfh-6jjg-67xg","title":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges...","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2025-07-08T15:32:04Z","modified":"2025-07-22T18:30:36Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T15:03:05.693325Z"}],"nvd":[{"id":"CVE-2025-7326","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2025-07-08T15:15:34.623Z","modified":"2026-06-17T10:04:44.367Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:11:17.727956Z"}],"osv":[{"id":"BIT-aspnet-core-2025-7326","title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2026-09-18T08:37:38.097Z","modified":"2026-10-22T09:00:02.45120359Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"BIT-dotnet-2025-7326","title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2026-09-18T08:39:50.434Z","modified":"2026-09-18T10:10:55.357485627Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"BIT-dotnet-sdk-2025-7326","title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","status":"published","published":"2026-09-18T08:39:50.604Z","modified":"2026-09-18T10:10:55.357485627Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}