Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability

<a name="executive-summary"></a>Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core 10.0 , ASP.NET Core 9.0 , ASP.NET Core 8.0, and ASP.NET Core 2.3. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.

Discussion

Discussion for this issue can be found at https://github.com/dotnet/announcements/issues/371

<a name="mitigation-factors"></a>Mitigation factors

Microsoft has not identified any mitigating factors for this vulnerability.

<a name="affected-software"></a>Affected software

Any ASP.NET Core 10.0 application running on ASP.NET Core 10.0.0-rc.1.25451.107 or earlier. Any ASP.NET Core 9.0 application running on ASP.NET Core 9.0.9 or earlier. Any ASP.NET Core application running on ASP.NET Core 8.0.20 or earlier. Any ASP.NET Core 2.x application consuming the package Microsoft.AspNetCore.Server.Kestrel.Core version 2.3.0 or earlier.

<a name="affected-packages"></a>Affected Packages The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below

Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.Server.Kestrel.Core | <= 2.3.0 | 2.3.6

<a name="ASP.NET Core 10"></a>ASP.NET Core 10 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.linux-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.osx-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.osx-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-arm | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-arm64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-x64 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107 Microsoft.AspNetCore.App.Runtime.win-x86 | 10.0.0-rc.1.25451.107 | 10.0.0-rc.2.25502.107

<a name="ASP.NET Core 9"></a>ASP.NET Core 9 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-arm | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0, <= 9.0.9 | 9.0.10 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0, <= 9.0.9 | 9.0.10

<a name="ASP.NET Core 8"></a>ASP.NET Core 8 Package name | Affected version | Patched version ------------ | ---------------- | ------------------------- Microsoft.AspNetCore.App.Runtime.linux-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-musl-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.linux-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.osx-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.osx-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-arm | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0, <= 8.0.20 | 8.0.21 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0, <= 8.0.20 | 8.0.21

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

If you have a runtime or SDK with a version listed, or an affected package listed in affected software or affected packages, you're exposed to the vulnerability.

<a name="how-fix"></a>How do I fix the issue?

1. To fix the issue please install the latest version of .NET 9.0 and .NET 8.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs. 2. If your application references the vulnerable package, update the package reference to the patched version.

You can list the versions you have installed by running the dotnet --info command. You will see output like the following;

.NET SDK: Version: 9.0.100 Commit: 59db016f11 Workload version: 9.0.100-manifests.3068a692 MSBuild version: 17.12.7+5b8665660

Runtime Environment: OS Name: Mac OS X OS Version: 15.2 OS Platform: Darwin RID: osx-arm64 Base Path: /usr/local/share/dotnet/sdk/9.0.100/

.NET workloads installed: There are no installed workloads to display. Configured to use loose manifests when installing new manifests.

Host: Version: 9.0.0 Architecture: arm64 Commit: 9d5a6a9aa4

.NET SDKs installed: 9.0.100 [/usr/local/share/dotnet/sdk]

.NET runtimes installed: Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App] Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found: x64 [/usr/local/share/dotnet] registered at [/etc/dotnet/installlocationx64]

Environment variables: Not set

global.json file: Not found

Learn more: https://aka.ms/dotnet/info

Download .NET: https://aka.ms/dotnet/download

If you're using .NET 8.0, you should download and install .NET 8.0.21 Runtime or .NET 8.0.318 SDK (for Visual Studio 2022 v17.10 latest update) from https://dotnet.microsoft.com/download/dotnet-core/8.0. If you're using .NET 9.0, you should download and install .NET 9.0.10 Runtime or .NET 9.0.111 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/9.0. If you're using .NET 10.0, you should download and install .NET 10.0.0-rc.2.25476.107 Runtime or .NET 10.0.100-rc.2.25476.107 SDK (for Visual Studio 2022 v17.12 latest update) from https://dotnet.microsoft.com/download/dotnet-core/10.0. If you're using Microsoft.AspNetCore.Server.Kestrel.Core nuget package, update to the latest version 2.3.6 using either of the following methods:

Using the NuGet Package Manager UI in Visual Studio: - Open your project in Visual Studio. - Right-click on your project in Solution Explorer and select "Manage NuGet Packages..." or navigate to "Project > Manage NuGet Packages". - In the NuGet Package Manager window, select the "Updates" tab. This tab lists packages with available updates from your configured package sources. - Select the package(s) you wish to update. You can choose a specific version from the dropdown or update to the latest available version. - Click the "Update" button.

Using the NuGet Package Manager Console in Visual Studio: - Open your project in Visual Studio. - Navigate to "Tools > NuGet Package Manager > Package Manager Console". - To update a specific package to its latest version, use the Update-Package command: Code:

Update-Package -Id Microsoft.AspNetCore.Server.Kestrel.Core

Using the .NET CLI (Command Line Interface): Open a terminal or command prompt in your project's directory. To update a specific package to its latest version: Code:

dotnet add package Microsoft.AspNetCore.Server.Kestrel.Core

Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.

Additionally, if you've deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Other Information

Reporting Security Issues

If you have found a potential security issue in .NET 8.0, .NET 9.0 or .NET 10.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core & .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at <https://aka.ms/corebounty>.

Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. External Links

Acknowledgement Sid

CVE-2025-55315

Revisions

V1.0 (October 14, 2025): Advisory published.

Version 1.0

Last Updated 2025-10-14

Chromium: CVE-2025-10585 Type Confusion in V8

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.

A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.

[Spoofable identity claims] Authentication Bypass by Assumed-Immutable Data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

Azure Automation Elevation of Privilege Vulnerability

Azure Storage Resource Provider Spoofing Vulnerability

Commvault Command Center contains a path traversal vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code.

Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.

A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)

Accessibility. An authorization issue was addressed with improved state management.

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. This vulnerability has already been mitigated in the service and all affected customers have been notified. This update addressed the registration control bypass. Affected customers have been given instructions on reviewing their sites for potential exploitation and clean up methods. If you've not been notified this vulnerability does not affect you.

Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability

Windows NTLM V1 Elevation of Privilege Vulnerability

Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

Windows OLE Remote Code Execution Vulnerability

A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAXDIGESTLEN exceeds the fixed SUMLENGTH (16 bytes), an attacker can write out of bounds in the sum2 buffer.

An improper access control vulnerability in Partner.Microsoft.com allows an a unauthenticated attacker to elevate privileges over a network.

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API. The supplier has stated that InfluxDB 2.8.0 has addressed this issue.

Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.