First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-47303

HighCVSS 8.8/10Last modified Jul 22, 2026

Description

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-90 CWE-302 CWE-863

Affected software

Vendor	Product	Versions
Microsoft	.NET 10.0	>= 10.0.0, < 10.0.10
Microsoft	.NET 8.0	>= 8.0.0, < 8.0.29
Microsoft	.NET 9.0	>= 9.0.0, < 9.0.18
Microsoft	Microsoft Visual Studio 2022 version 17.12	>= 17.12.0, < 17.12.22
Microsoft	Microsoft Visual Studio 2022 version 17.14	>= 17.14.0, < 17.14.36
Microsoft	Microsoft Visual Studio 2026 version 18.7	>= 18.0, < 18.7.4

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47303Patch, Vendor Advisory

Timeline

Published: Jul 14, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-473049.8Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-473057.8Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally.CVE-2026-473066.1Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: CVE-2026-473077.5NULL pointer dereference vulnerability in Samsung Open Source Walrus allows an attacker to cause a denial of service via a crafted WebAssemb CVE-2026-473087.5NULL pointer dereference vulnerability in Samsung Open Source Walrus allows Pointer Manipulation. This issue affects Walrus: f339b8ee4ea701 CVE-2026-473097.5Uncontrolled Recursion vulnerability in Samsung Open Source Escargot allows Oversized Serialized Data Payloads. This issue affects Escargot CVE-2026-47318.5Integer Overflow or Wraparound vulnerability in artraweditor ART (‎rtengine‎ modules). This vulnerability is associated with program files d CVE-2026-473109.8Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da8 CVE-2026-473119.8Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258 CVE-2026-473127.5Release of invalid pointer or reference vulnerability in Samsung Open Source Escargot allows Buffer Manipulation. This issue affects Escarg CVE-2026-473137.5Memory allocation with excessive size value vulnerability in Samsung Open Source Escargot allows Excessive Allocation. This issue affects E CVE-2026-473149.8Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da

CVE-2026-47303: High severity, CVSS 8.8 | Vulnix