Accessibility. An authorization issue was addressed with improved state management.

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

[Spoofable identity claims] Authentication Bypass by Assumed-Immutable Data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC), aka 'Netlogon Elevation of Privilege Vulnerability'.

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

Azure Automation Elevation of Privilege Vulnerability

Azure Storage Resource Provider Spoofing Vulnerability

A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/announcements/issues/371

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

Any ASP.NET Core 10.0 application running on ASP.NET Core 10.0.0-rc.1.25451.107 or earlier. Any ASP.NET Core 9.0 application running on ASP.NET Core 9.0.9 or earlier. Any ASP.NET Core application running on ASP.NET Core 8.0.20 or earlier. Any ASP.NET Core 2.x application consuming the package Microsoft.AspNetCore.Server.Kestrel.Core version 2.3.0 or earlier.

<a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Server.Kestrel.Core | <= 2.3.0 | 2.3.6

<a name="ASP.NET Core 10"></a>ASP.NET Core 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.osx-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.osx-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-arm | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-x86 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107

<a name="ASP.NET Core 9"></a>ASP.NET Core 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.9 | 9.0.10

<a name="ASP.NET Core 8"></a>ASP.NET Core 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.20 | 8.0.21

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software or affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

1. To fix the issue please install the latest version of .NET 9.0 and .NET 8.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version.

You can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET SDK: Version: 9.0.100 Commit: 59db016f11 Workload version: 9.0.100-manifests.3068a692 MSBuild version: 17.12.7+5b8665660

Runtime Environment: OS Name: Mac OS X OS Version: 15.2 OS Platform: Darwin RID: osx-arm64 Base Path: /usr/local/share/dotnet/sdk/9.0.100/

.NET workloads installed: There are no installed workloads to display. Configured to use loose manifests when installing new manifests.

Host: Version: 9.0.0 Architecture: arm64 Commit: 9d5a6a9aa4

.NET SDKs installed: 9.0.100 [/usr/local/share/dotnet/sdk]

.NET runtimes installed: Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App] Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found: x64 [/usr/local/share/dotnet] registered at [/etc/dotnet/installlocationx64]

Environment variables: Not set

global.json file: Not found

Learn more: https://aka.ms/dotnet/info

Download .NET: https://aka.ms/dotnet/download

If you're using .NET 8.0, you should download and install .NET 8.0.21 Runtime or .NET 8.0.318 SDK (for Visual Studio 2022 v17.10 latest update) from https://dotnet.microsoft.com/download/dotnet-core/8.0. If you're using .NET 9.0, you should download and install .NET 9.0.10 Runtime or .NET 9.0.111 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/9.0. If you're using .NET 10.0, you should download and install .NET 10.0.0-rc.2.25476.107 Runtime or .NET 10.0.100-rc.2.25476.107 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/10.0. If you're using Microsoft.AspNetCore.Server.Kestrel.Core nuget package, update to the latest version 2.3.6 using either of the following methods:

Using the NuGet Package Manager UI in Visual Studio: - Open your project in Visual Studio. - Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. - Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. - Click the "Update" button.

Using the NuGet Package Manager Console in Visual Studio: - Open your project in Visual Studio. - Navigate to "Tools > NuGet Package Manager > Package Manager Console". - To update a specific package to its latest version, use the Update-Package command: Code:

Update-Package -Id Microsoft.AspNetCore.Server.Kestrel.Core

Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version: Code:

dotnet add package Microsoft.AspNetCore.Server.Kestrel.Core

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 8.0, .NET 9.0 or .NET 10.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links

Acknowledgement Sid

CVE-2025-55315

Revisions

V1.0 (October 14, 2025): Advisory published.

Version 1.0

Last Updated 2025-10-14

Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.

Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.

Argument Injection in PHP-CGI

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these previously mitigated vulnerabilities on Windows 10, version 1507 (Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB) systems that have installed the Windows security update released on March 12, 2024—KB5035858 (OS Build 10240.20526) or other updates released until August 2024. All later versions of Windows 10 are not impacted by this vulnerability. This servicing stack vulnerability is addressed by installing the September 2024 Servicing stack update (SSU KB5043936) AND the September 2024 Windows security update (KB5043083), in that order. Note: Windows 10, version 1507 reached the end of support (EOS) on May 9, 2017 for devices running the Pro, Home, Enterprise, Education, and Enterprise IoT editions. Only Windows 10 Enterprise 2015 LTSB and Windows 10 IoT Enterprise 2015 LTSB editions are still under support.

Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

Windows NTLM V1 Elevation of Privilege Vulnerability

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Windows OLE Remote Code Execution Vulnerability

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

Chromium: CVE-2025-10585 Type Confusion in V8

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.