CVE-2023-36899

CVE-2023-36899 is an Elevation of Privilege vulnerability in ASP.NET, affecting various versions of Microsoft .NET Framework and Windows operating systems, including Windows 10, 11, and Server editions. With a CVSS score of 8.8 (HIGH), this vulnerability is network-exploitable with low attack complexity, allowing an authenticated attacker to achieve high impact on confidentiality, integrity, and availability. While it has a high EPSS score and FAUCET Risk Score, indicating significant potential risk, there is currently no evidence of active exploitation, nor are there public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, with only one article mentioning it as part of Microsoft's August 2023 Patch Tuesday.