An origin validation flaw in the .NET framework permits an attacker who is not otherwise authenticated to learn sensitive information by sending requests that exploit the vulnerability. The weakness corresponds to CWE‑346, which highlights failures in properly validating the source of requests. The effect is the leakage of data that was not intended for external disclosure. The CVSS score of 5.3 places this flaw in the moderate severity range, indicating a credible risk to confidentiality if exploited.

Microsoft offers affected products across a range of .NET versions, specifically .NET 10.0, .NET 11.0, .NET 8.0, and .NET 9.0, as well as Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10. These products cover both runtime components and development environments for the .NET ecosystem.

The flaw can be triggered over a network by sending crafted requests that bypass normal origin checks, allowing an attacker to extract information from the target system. The exploit does not require privileged local access; remote actors can trigger the vulnerability from outside the network. While the EPSS score for this flaw is not reported, the lack of inclusion in the CISA KEV catalog and the moderate CVSS score suggest a lower but still real likelihood of exploitation in the wild. Organizations are advised to treat the vulnerability with the same priority as other moderate‑severity information‑disclosure issues.