CVE-2023-35391: ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-08 · updated 2026-08-10

Description

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Affected products

Microsoft .NET: from 6.0.0 before 6.0.21; from 7.0.0 before 7.0.10 — fixed in 6.0.21, 7.0.10
Microsoft .NET Core: from 2.1 before 2.1.40 — fixed in 2.1.40
Microsoft Visual Studio 2022 version 17.14: from 17.2.0 before 17.2.18; from 17.4.0 before 17.4.10; from 17.6.0 before 17.6.6 — fixed in 17.2.18, 17.4.10, 17.6.6
Microsoft .NET 6.0: from 6.0.0 before 6.0.21 — fixed in 6.0.21
Microsoft .NET 7.0: from 7.0.0 before 7.0.10 — fixed in 7.0.10
Microsoft ASP.NET Core 2.1: from 2.0 before 2.1.40 — fixed in 2.1.40
Microsoft Visual Studio 2022 version 17.2: from 17.2.0 before 17.2.18 — fixed in 17.2.18
Microsoft Visual Studio 2022 version 17.4: from 17.4.0 before 17.4.10 — fixed in 17.4.10
Microsoft Visual Studio 2022 version 17.6: from 17.6.0 before 17.6.6 — fixed in 17.6.6

How to fix

Upgrade to a fixed version: Microsoft .NET 6.0.21, 7.0.10; Microsoft .NET Core 2.1.40; Microsoft Visual Studio 2022 version 17.14 17.2.18, 17.4.10, 17.6.6; Microsoft .NET 6.0 6.0.21; Microsoft .NET 7.0 7.0.10; Microsoft ASP.NET Core 2.1 2.1.40; Microsoft Visual Studio 2022 version 17.2 17.2.18; Microsoft Visual Studio 2022 version 17.4 17.4.10; Microsoft Visual Studio 2022 version 17.6 17.6.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-35391 or the next vulnerability affects your stack