Microsoft ASP.NET Core vulnerabilities

41 CVEs affecting Microsoft ASP.NET Core, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-88092, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
• CVE-2023-38180: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability, published 2023-08-08. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-08-09. EPSS: 14% chance of exploitation in the next 30 days. .NET and Visual Studio Denial of Service Vulnerability
• CVE-2025-55315, published 2025-10-14. Critical severity, CVSS 9.9. EPSS: 65.9% chance of exploitation in the next 30 days. Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
• CVE-2020-0603, published 2020-01-14. High severity, CVSS 8.8. EPSS: 21% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary…
• CVE-2018-8292, published 2018-10-10. High severity, CVSS 7.5. EPSS: 14.8% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects…
• CVE-2018-8171, published 2018-07-11. High severity, CVSS 7.5. EPSS: 10.8% chance of exploitation in the next 30 days. A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Security Feature Bypass Vulnerability." This affects ASP.NET,…
• CVE-2017-8700, published 2017-11-15. High severity, CVSS 7.5. EPSS: 10.5% chance of exploitation in the next 30 days. ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core…
• CVE-2018-0787, published 2018-03-14. High severity, CVSS 8.8. EPSS: 9.6% chance of exploitation in the next 30 days. ASP.NET Core 1.0. 1.1, and 2.0 allow an elevation of privilege vulnerability due to how web applications that are created from templates validate web requests, aka "ASP.NET Core Elevation Of…
• CVE-2017-11879, published 2017-11-15. High severity, CVSS 8.8. EPSS: 9.4% chance of exploitation in the next 30 days. ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
• CVE-2018-0875, published 2018-03-14. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service…

Latest

• CVE-2026-88092, published 2026-10-13. Critical severity, CVSS 9.4. EPSS: 0.8% chance of exploitation in the next 30 days. Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.
• CVE-2026-69304, published 2026-09-08. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-45591, published 2026-06-09. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-40372, published 2026-04-21. Critical severity, CVSS 9.1. EPSS: 0.8% chance of exploitation in the next 30 days. Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-26130, published 2026-03-10. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2025-26682, published 2025-04-08. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2025-24070, published 2025-03-11. High severity, CVSS 7.0. EPSS: 1% chance of exploitation in the next 30 days. Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network.
• CVE-2024-21404, published 2024-02-13. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. .NET Denial of Service Vulnerability
• CVE-2024-21386, published 2024-02-13. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. .NET Denial of Service Vulnerability