CVE-2023-36799

25

FAUCET Score

CVE-2023-36799 is a Denial of Service vulnerability affecting Microsoft .NET Core and Visual Studio 2022. It has a CVSS score of 6.5 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, to cause a high impact on availability. While not actively exploited (KEV: No) and lacking public exploit code (Metasploit, Nuclei, ExploitDB: None), it has garnered limited community discussion and media coverage, primarily noted in Microsoft's September 2023 Patch Tuesday.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		6.0.0CPE matchmatch criteria	cpe:2.3:a:microsoft:.net:6.0.0:-::::::
		7.0.0CPE matchmatch criteria	cpe:2.3:a:microsoft:.net:7.0.0:::::::*
		>= 17.2, < 17.2.19CPE matchmatch criteria	cpe:2.3:a:microsoft:visual_studio_2022::::::::
		>= 17.4, < 17.4.11CPE matchmatch criteria	cpe:2.3:a:microsoft:visual_studio_2022::::::::
		>= 17.6, < 17.6.7CPE matchmatch criteria	cpe:2.3:a:microsoft:visual_studio_2022::::::::

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

Exploitability Score

2.8

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

4.87%

Probability of exploitation in next 30 days

EPSS Percentile

91.1%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0487 is in the 96th percentile among its peer group of 26,236 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (31)

microsoftpatch availablevia nvd_reference

microsoftpatch availablevia msrc

Product: .NET 6.0Fixed in: 6.0.24

microsoftpatch availablevia msrc

Product: .NET 7.0Fixed in: 7.0.13

microsoftpatch availablevia msrc

Product: Microsoft Visual Studio 2022 version 17.2Fixed in: 17.2.21

microsoftpatch availablevia msrc

Product: Microsoft Visual Studio 2022 version 17.4Fixed in: 17.4.13

microsoftpatch availablevia msrc

Product: Microsoft Visual Studio 2022 version 17.7Fixed in: 17.6.9

microsoftpatch availablevia msrc

Product: Microsoft Visual Studio 2022 version 17.6Fixed in: 17.6.9

microsoftpatch availablevia msrc

Product: PowerShell 7.2Fixed in: 7.2.14

microsoftpatch availablevia msrc

Product: PowerShell 7.3Fixed in: 7.2.14

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-musl-armFixed in: 6.0.22

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-armFixed in: 6.0.22

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-arm64Fixed in: 6.0.22

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-musl-arm64Fixed in: 6.0.22

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-arm64Fixed in: 7.0.11

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-musl-arm64Fixed in: 7.0.11

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-armFixed in: 7.0.11

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-musl-armFixed in: 7.0.11

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-musl-x64Fixed in: 7.0.11

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-x64Fixed in: 7.0.11

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-x64Fixed in: 6.0.22

nugetpatch availablevia ghsa

Product: Microsoft.NETCore.App.Runtime.linux-musl-x64Fixed in: 6.0.22

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: dotnet6.0-0:6.0.124-1.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: dotnet7.0-0:7.0.113-1.el9_2

redhatpatch availablevia redhat_api

Product: .NET Core on Red Hat Enterprise LinuxFixed in: rh-dotnet60-dotnet-0:6.0.122-1.el7_9

redhatpatch availablevia redhat_api

Product: .NET Core on Red Hat Enterprise LinuxFixed in: rh-dotnet60-dotnet-0:6.0.124-1.el7_9

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: dotnet6.0-0:6.0.122-1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: dotnet7.0-0:7.0.111-1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: dotnet6.0-0:6.0.124-1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: dotnet7.0-0:7.0.113-1.el8_8

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: dotnet6.0-0:6.0.122-1.el9_2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: dotnet7.0-0:7.0.111-1.el9_2

Vendor Advisories (3)

redhatCVE-2023-36799Moderate

dotnet: Denial of Service with Client Certificates using .NET Kestrel

nugetGHSA-h3hv-63q5-jgprmedium

Microsoft Security Advisory CVE-2023-36799: .NET Denial of Service Vulnerability

microsoft2023-Sep/CVE-2023-36799Important

.NET Core and Visual Studio Denial of Service Vulnerability

References

msrc.microsoft.com / update-guide/vulnerability/CVE-2023-36799

PatchVendor Advisory