HIGH · CVSS 7.5
ACTIVELY EXPLOITED
PATCH AVAILABLE
CVE-2023-38180: Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability
| Vendor | Microsoft |
|---|---|
| Product | .NET Core and Visual Studio |
| CVSS score | 7.5 · CVSS 3.1 · HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Actively exploited | Yes |
| Added to CISA KEV | 9 Aug 2023 |
| CISA federal deadline | 30 Aug 2023 |
| Weakness (CWE) | CWE-400 |
| NVD published | 8 Aug 2023 |
| NVD last modified | 10 Nov 2026 |
| NVD status | Analyzed |
Affected versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft .Net | from 6.0.0 before 6.0.21 | 6.0.21 |
| Microsoft .Net | from 7.0.0 before 7.0.10 | 7.0.10 |
| Microsoft Asp.Net Core | from 2.1 before 2.1.40 | 2.1.40 |
| Microsoft Visual Studio 2022 | from 17.2.0 before 17.2.18 | 17.2.18 |
| Microsoft Visual Studio 2022 | from 17.4.0 before 17.4.10 | 17.4.10 |
| Microsoft Visual Studio 2022 | from 17.6.0 before 17.6.6 | 17.6.6 |
| Fedoraproject Fedora | 37 | – |
| Fedoraproject Fedora | 38 | – |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
.NET and Visual Studio Denial of Service Vulnerability
SOURCES
Other Microsoft flaws
- patchtuesday:2026-11: Vulnerability in Microsoft
- CVE-2026-124194: Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability
- CVE-2026-96951: Microsoft Windows Command Injection Vulnerability
- CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability
- CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.