What’s Vulnerable › Vulnerabilities
CVE-2025-7326: EOL ASP.NET Core Elevation of Privilege Vulnerability
- Severity: high (CVSS 7.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-08 · updated 2026-06-17
- Weakness: CWE-1390
Description
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Affected products
- Microsoft ASP.NET Core 6.0: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.linux-arm: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.linux-arm64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.linux-musl-arm64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.linux-musl-x64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.linux-x64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.osx-arm64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.osx-x64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.win-arm: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.win-arm64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.win-x64: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.App.Runtime.win-x86: from >=6.0.0 through 6.0.36
- Microsoft.AspNetCore.Identity: from >=6.0.0 through 6.0.36
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070
- https://www.cve.org/CVERecord?id=CVE-2025-24070
- https://www.herodevs.com/vulnerability-directory/cve-2025-7326
- https://www.herodevs.com/vulnerability-directory/cve-2025-7326?nes-for-.net
Get alerted when CVE-2025-7326 or the next vulnerability affects your stack