CVE-2025-24070: ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-11 · updated 2026-06-17
Weakness: CWE-1390

Description

Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Affected products

Microsoft .NET Core: from 8.0.0 before 8.0.14; from 9.0.0 before 9.0.3 — fixed in 8.0.14, 9.0.3
Microsoft Visual Studio 2022 version 17.14: from 17.8.0 before 17.8.19; from 17.10.0 before 17.10.12; from 17.12.0 before 17.12.6; from 17.13.0 before 17.13.3 — fixed in 17.10.12, 17.12.6, 17.13.3, 17.8.19
Microsoft ASP.NET Core 8.0: from 8.0 before 8.0.14 — fixed in 8.0.14
Microsoft ASP.NET Core 9.0: from 9.0 before 9.0.3 — fixed in 9.0.3
Microsoft Visual Studio 2022 version 17.10: from 17.10.0 before 17.10.12 — fixed in 17.10.12
Microsoft Visual Studio 2022 version 17.13: from 17.13.0 before 17.13.3 — fixed in 17.13.3
Microsoft Visual Studio 2022 version 17.8: from 17.8.0 before 17.8.19 — fixed in 17.8.19
Microsoft Visual Studio 2022 version 17.14: from 17.12.0 before 17.12.6 — fixed in 17.12.6

How to fix

Upgrade to a fixed version: Microsoft .NET Core 8.0.14, 9.0.3; Microsoft Visual Studio 2022 version 17.14 17.10.12, 17.12.6, 17.13.3, 17.8.19; Microsoft ASP.NET Core 8.0 8.0.14; Microsoft ASP.NET Core 9.0 9.0.3; Microsoft Visual Studio 2022 version 17.10 17.10.12; Microsoft Visual Studio 2022 version 17.13 17.13.3; Microsoft Visual Studio 2022 version 17.8 17.8.19; Microsoft Visual Studio 2022 version 17.14 17.12.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-24070 or the next vulnerability affects your stack