{"id":"CVE-2025-7326","state":"PUBLISHED","title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","description":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry.","publishedAt":"2025-07-08T14:31:45.633Z","updatedAt":"2025-07-22T15:20:41.162Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","source":"HeroDevs"},"assigner":"HeroDevs","products":["Microsoft ASP.NET Core 6.0","Microsoft Microsoft.AspNetCore.Identity","Microsoft Microsoft.AspNetCore.App.Runtime.win-arm","Microsoft Microsoft.AspNetCore.App.Runtime.win-arm64","Microsoft Microsoft.AspNetCore.App.Runtime.win-x64","Microsoft Microsoft.AspNetCore.App.Runtime.win-x86","Microsoft Microsoft.AspNetCore.App.Runtime.linux-arm","Microsoft Microsoft.AspNetCore.App.Runtime.linux-arm64","Microsoft Microsoft.AspNetCore.App.Runtime.linux-musl-arm","Microsoft Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","Microsoft Microsoft.AspNetCore.App.Runtime.linux-musl-x64","Microsoft Microsoft.AspNetCore.App.Runtime.linux-x64","Microsoft Microsoft.AspNetCore.App.Runtime.osx-arm64","Microsoft Microsoft.AspNetCore.App.Runtime.osx-x64"],"affected":[{"vendor":"Microsoft","product":"ASP.NET Core 6.0","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.Identity","packageName":"Microsoft.AspNetCore.Identity","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows","Linux","MacOS"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-arm","packageName":"Microsoft.AspNetCore.App.Runtime.win-arm","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.win-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-x64","packageName":"Microsoft.AspNetCore.App.Runtime.win-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-x86","packageName":"Microsoft.AspNetCore.App.Runtime.win-x86","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-arm","packageName":"Microsoft.AspNetCore.App.Runtime.linux-arm","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","packageName":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-x64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.osx-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.osx-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["MacOS"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.osx-x64","packageName":"Microsoft.AspNetCore.App.Runtime.osx-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["MacOS"]}],"references":["https://www.cve.org/CVERecord?id=CVE-2025-24070","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070","https://www.herodevs.com/vulnerability-directory/cve-2025-7326","https://www.herodevs.com/vulnerability-directory/cve-2025-7326?nes-for-.net"],"weaknesses":["CWE-1390"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/7xxx/CVE-2025-7326.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-7326","state":"PUBLISHED","datePublished":"2025-07-08T14:31:45.633Z","dateUpdated":"2025-07-22T15:20:41.162Z","assignerShortName":"HeroDevs","assignerOrgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","dateReserved":"2025-07-07T15:43:27.241Z"},"containers":{"cna":{"title":"EOL ASP.NET Core Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.\n\nNOTE: This CVE affects only End Of Life (EOL) software components. The vendor, Microsoft, has indicated there will be no future updates nor support provided upon inquiry."}],"affected":[{"vendor":"Microsoft","product":"ASP.NET Core 6.0","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Unknown"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.Identity","packageName":"Microsoft.AspNetCore.Identity","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows","Linux","MacOS"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-arm","packageName":"Microsoft.AspNetCore.App.Runtime.win-arm","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.win-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-x64","packageName":"Microsoft.AspNetCore.App.Runtime.win-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.win-x86","packageName":"Microsoft.AspNetCore.App.Runtime.win-x86","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Windows"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-arm","packageName":"Microsoft.AspNetCore.App.Runtime.linux-arm","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","packageName":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-musl-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-musl-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.linux-x64","packageName":"Microsoft.AspNetCore.App.Runtime.linux-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["Linux"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.osx-arm64","packageName":"Microsoft.AspNetCore.App.Runtime.osx-arm64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["MacOS"]},{"vendor":"Microsoft","product":"Microsoft.AspNetCore.App.Runtime.osx-x64","packageName":"Microsoft.AspNetCore.App.Runtime.osx-x64","defaultStatus":"unaffected","versions":[{"version":">=6.0.0","status":"affected","lessThanOrEqual":"6.0.36","versionType":"semver"}],"platforms":["MacOS"]}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-24070","name":"ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability","tags":["related"]},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24070","tags":["vendor-advisory"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-7326"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1390","description":"CWE-1390: Weak Authentication","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"HeroDevs","orgId":"36c7be3b-2937-45df-85ea-ca7133ea542c","dateUpdated":"2025-07-10T17:30:15.501Z"},"datePublic":"2025-07-08T14:30:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2025-7326?nes-for-.net","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-22T15:20:38.013408Z","id":"CVE-2025-7326","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-22T15:20:41.162Z"}}]}}}