Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-47300 is a high-severity Incorrect Implementation of Authentication Algorithm (CWE-303) vulnerability in Microsoft .Net. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-44342
Vulnerability Data
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-303 auth implementation flaw in ASP.NET Core enables network-based privilege escalation from authorized access, directly mapping to exploitation for priv esc and public-facing app exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access decisions derived from authentication results, blocking the privilege escalation that stems from the flawed authentication algorithm.
Requires reliable identification and authentication of users before granting access, directly addressing the incorrect authentication algorithm implementation.
Limits privileges to the minimum required, reducing the impact of any successful elevation achieved through the authentication flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct implementation of authentication algorithms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure authentication control directly requires correct implementation of authentication algorithms.
Security testing can detect flawed authentication implementations but does not prevent them by itself.
Cryptography control addresses proper use of authentication algorithms but is broader than authentication alone.
Secure development lifecycle includes verification steps that can catch incorrect authentication implementations.
Application security requirements can specify correct authentication algorithm use but do not guarantee correct implementation.
Secure coding practices reduce the likelihood of incorrect authentication algorithm implementation.