CVE-2023-36899: Microsoft .NET Framework ASP.NET elevation of privilege via improper input validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability and high EPSS (99.52nd percentile) indicate significant risk, though low privileges are required and no KEV listing or public exploit is confirmed in the record.

What it is

CVE-2023-36899 is an elevation of privilege flaw in Microsoft ASP.NET, part of the .NET Framework, caused by improper input validation (CWE-20). A network-reachable attacker with low privileges can exploit it to gain high confidentiality, integrity, and availability impact, making it a serious risk for exposed ASP.NET applications.

Impact

An attacker who successfully exploits this flaw can elevate privileges within the affected ASP.NET application context, potentially gaining control over application data and functionality. The CVSS vector indicates high impact to confidentiality, integrity, and availability.

Attack surface

The vulnerability is reachable over the network (AV:N) with low attack complexity and no user interaction required. Authentication is required at the low-privilege level (PR:L), so the attacker needs some valid credentials or access to the application.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit references beyond the vendor patch advisory. EPSS is very high (0.76714, 99.52nd percentile), indicating a strong likelihood of exploitation activity, but no confirmed public exploit is documented in the supplied data.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2023-36899 as soon as possible.
• Inventory internet-facing and internal ASP.NET applications running on .NET Framework and confirm patch status.
• Restrict network access to ASP.NET endpoints where feasible and enforce least privilege for application accounts.
• Monitor for suspicious privilege escalation or unusual application behavior in ASP.NET workloads after patching.

Detection

• Review ASP.NET application logs for anomalous requests or privilege changes that could indicate exploitation attempts.
• Correlate authentication events with subsequent high-privilege actions in .NET Framework application logs.
• Use endpoint detection to flag unusual child processes or file writes originating from ASP.NET worker processes (w3wp.exe).

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.