VulnSocial

CVE-2023-36899Exploit(microsoft / .net_framework)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch microsoft .net_framework systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ASP.NET Elevation of Privilege Vulnerability

microsoft CVEsBack to dashboard
1.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-20

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • .net_framework
  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Exploit: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
microsoft
Products
.net_frameworkwindows_10_1809windows_10_21h2windows_10_22h2windows_11_21h2windows_server_2008windows_server_2012windows_server_2016windows_server_2019windows_server_2022

10 versions affected across 10 products

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-08-11: 1Patch / Workaround · 2026-08-11: 1Technical Details · 2026-08-11: 108-11
Signal classification1 categories
Exploit
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Soroush Dalili@irsdl
    Exploit

    A URL-encoded ASP .NET Cookieless marker could partially bypass the CVE-2023-36899 fix and cross IIS application boundaries. http://x.com/i/article/2087269856156467201

    Post summary

    The tweet indicates that a URL‑encoded ASP .NET Cookieless marker can partially bypass the CVE‑2023‑36899 fix, enabling cross‑application boundary attacks, but no evidence of active exploitation or PoC code is presented.

    08151235.7K
    20.1K followersView on X
CPE platform detail27 entries

27 of 27 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoft.net_framework2.0--
Appmicrosoft.net_framework3.5--
Appmicrosoft.net_framework4.6.2--
Appmicrosoft.net_framework4.7--
Appmicrosoft.net_framework4.7.1--
Appmicrosoft.net_framework4.7.2--
Appmicrosoft.net_framework4.8--
Appmicrosoft.net_framework4.8.1--
OSmicrosoftwindows_10_1809--arm64
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2--arm64
OSmicrosoftwindows_10_21h2--x64
OSmicrosoftwindows_10_21h2--x86
OSmicrosoftwindows_10_22h2--arm64
OSmicrosoftwindows_10_22h2--x64
OSmicrosoftwindows_10_22h2--x86
OSmicrosoftwindows_11_21h2--arm64
OSmicrosoftwindows_11_21h2--x64
OSmicrosoftwindows_server_2008--x64
OSmicrosoftwindows_server_2008--x86
OSmicrosoftwindows_server_2008r2-x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016---
OSmicrosoftwindows_server_2019---
OSmicrosoftwindows_server_2022---

Explore more

Back to dashboardmicrosoft CVEs.net_framework vulnerabilities