The vulnerability arises from an origin validation error in the .NET runtime. An attacker who can send crafted network requests to a .NET application may bypass a built‑in security check, allowing execution of privileged code or operations that should be restricted. This bypass leads to a loss of integrity of the application’s access control and could enable unauthorized functionality. The weakness is classified as CWE‑346, which involves improper handling of validation that results in a trust or logic flaw.

Affected Microsoft products include all supported releases of the .NET framework from version 8.0 through 11.0 and the Visual Studio IDEs in the 2022 and 2026 releases (17.14 and 18.10 respectively). Systems running any of those runtimes or IDEs are at risk unless they have received the official update.

The CVSS score of 6.5 indicates a moderate risk. The exploit probability metric (EPSS) is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote, over a network connection, where an attacker crafts requests that the .NET engine accepts as coming from a trusted source. While no publicly known exploits currently exist, the potential for an attacker to elevate privileges or access protected resources warrants prompt remediation.