The vulnerability originates from an improperly implemented security check for a .NET standard that allows an unauthorized attacker to execute code over a network. If the flaw is successfully exploited, the attacker can run arbitrary code with the privileges of the affected process, leading to full compromise of the target system. The weakness is a missing or flawed authorization boundary, classified as CWE‑358.

Affected products span Microsoft’s .NET ecosystem. The vulnerability applies to .NET 8.0, 9.0, 10.0, 11.0, the .NET Framework from version 3.5 through 4.8.1, and the Visual Studio IDE in its 2022 (17.14) and 2026 (18.10) releases. The CNA vendor list enumerates specific combinations of .NET Framework 3.5 with various 4.x releases, indicating that any installation that contains the affected runtime components is susceptible.

The CVSS score of 8.8 labels it as high severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified, but the vulnerability is reachable over the network, implying a remote attack vector. The issue has not yet been catalogued in CISA’s KEV, and no official workaround is published, so users should apply the security updates as soon as possible.