CVE-2025-7326

EOL ASP.NET Core Elevation of Privilege Vulnerability

Published Jul 8, 2025 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Description
Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-20507 Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
History
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Metrics epss

{'score': 0.00051}

epss

{'score': 0.00066}

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.
Title EOL ASP.NET Core Elevation of Privilege Vulnerability
Weaknesses CWE-1390
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
HeroDevs
Published
Updated
Jul 22, 2025, 3:20 PM
Reserved
Jul 7, 2025, 3:43 PM
Status
Deferred
Published
Jul 8, 2025, 3:15 PM
Modified
Jun 17, 2026, 10:04 AM