CVE-2025-26682

HIGH 7.5CVE-2025-26682 · Published 08/04/2025 · updated 17/06/2026

In short

CVE-2025-26682 is a HIGH (CVSS 7.5) vulnerability affecting asp.net core (microsoft), visual studio 2022 (microsoft).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.9% of all vulnerabilities.
Fix: update to 8.0.15, 9.0.4, 17.10.13, 17.12.7 or later.

Package	Affected versions	Patched versions
asp.net core microsoft	`≥ 8.0.0, < 8.0.15≥ 9.0.0, < 9.0.4`	`8.0.159.0.4`
visual studio 2022 microsoft	`≥ 17.10.0, < 17.10.13≥ 17.12.0, < 17.12.7≥ 17.13.0, < 17.13.6≥ 17.8.0, < 17.8.20`	`17.10.1317.12.717.13.617.8.20`

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 8.0.0, < 8.0.15≥ 9.0.0, < 9.0.4

8.0.159.0.4

≥ 17.10.0, < 17.10.13≥ 17.12.0, < 17.12.7≥ 17.13.0, < 17.13.6≥ 17.8.0, < 17.8.20

17.10.1317.12.717.13.617.8.20

More vulnerabilities in asp.net core

See all →