Microsoft Microsoft.aspnetcore.identity vulnerabilities

2 CVEs affecting Microsoft Microsoft.aspnetcore.identity, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-36854, published 2025-09-08.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-7326, published 2025-07-08. High severity, CVSS 7.0. EPSS: 0.7% chance of exploitation in the next 30 days. Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) software components. The vendor,…
• CVE-2025-36854, published 2025-09-08. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability ( CVE-2024-38229 https://www.cve.org/CVERecord ) exists in EOL ASP.NET when closing an HTTP/3 stream while application code is writing to the response body, a race condition may lead…