CASCACascade Atlas

Evidence dossier

CVE-2024-29059

.NET Framework Information Disclosure Vulnerability

Exploited in the wild (CISA KEV since Feb 4, 2025). microsoft reports CVSS 3.1 7.5. EPSS estimates 98.6% exploit likelihood as of Aug 8, 2026.

81.3–88.4Priority evidence range
Evidence current through Aug 27, 2026, 6:09 PM UTC

As of Aug 27, 2026

Normalized restatement

.NET Framework Information Disclosure Vulnerability

State
PUBLISHED
Published
Mar 22, 2024
Updated
Oct 21, 2025
Evidence coverage
94%

Evidence chronology

What was known when

Download this view's receipt →
  1. Source dateSource date omittedFirst observed by CASCA
    CISA-ADP

    Record text: CISA ADP Vulnrichment

    Inspect raw assertion
    Field
    container
    Value
    CISA ADP Vulnrichment
    Original evidence ↗
  2. Source dateSource date omittedFirst observed by CASCA
    CVE Program

    Record text: CVE Program Container

    Inspect raw assertion
    Field
    container
    Value
    CVE Program Container
    Original evidence ↗
  3. Source dateSource date omittedFirst observed by CASCA
    microsoft

    Record text: .NET Framework Information Disclosure Vulnerability

    Inspect raw assertion
    Field
    container
    Value
    .NET Framework Information Disclosure Vulnerability
    Original evidence ↗
  4. Source dateFirst observed by CASCA
    CISA KEV

    Exploitation cataloged: Microsoft .NET Framework Information Disclosure Vulnerability

    Inspect raw assertion
    Field
    observed_exploitation
    Value
    Microsoft .NET Framework Information Disclosure Vulnerability
    Original evidence ↗
  5. Source dateFirst observed by CASCA
    FIRST EPSS

    EPSS score: 98.62% probability · 99.92th percentile

    Inspect raw assertion
    Field
    model_probability
    Value
    Probability 0.986240000000; percentile 0.999190000000
    Original evidence ↗
ExploitationCatalog member

CISA KEV · catalog date Feb 4, 2025 · first observed Jul 19, 2026

Exploit likelihood98.62%

FIRST EPSS · score date Aug 8, 2026 · 99.9th percentile · first observed Aug 8, 2026

SeverityCVSS 7.5

microsoft · CVSS 3.1 · first observed Jul 19, 2026 · same-version scores align in this snapshot

Evidence detail

Source limits and decisions

Why each evidence state has this value

casca-unknown-reasons-v1
Exploitation statusEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Exploit likelihoodEvidence supported

Eligible evidence is present for this bounded claim.

Revision
evidence-policy-v1.1.0
Cutoff
Aug 27, 2026
Resolution
None
Severity assessmentEvidence supported

Eligible evidence is present for this bounded claim.

Revision
casca-direct-cvss-eligibility-v1
Cutoff
Aug 27, 2026
Resolution
None
Affected productsSource-reported scope

The cited source assertion is retained while canonical product linkage remains open.

Revision
casca-factor-d-obligations-v1
Cutoff
Aug 27, 2026
Resolution
Resolve identity

Source comparison

Who said what

CISA-ADPIndependent enrichment
Record text

CISA ADP Vulnrichment

Inspect raw assertion
Field
container
Value
CISA ADP Vulnrichment
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CVE ProgramDerivative copy
Record text

CVE Program Container

Inspect raw assertion
Field
container
Value
CVE Program Container
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
microsoftOriginal assertion
Record text

.NET Framework Information Disclosure Vulnerability

Inspect raw assertion
Field
container
Value
.NET Framework Information Disclosure Vulnerability
Source dateSource date omittedFirst observed by CASCAOriginal evidence ↗
CISA KEVOriginal assertion
Exploitation cataloged

Microsoft .NET Framework Information Disclosure Vulnerability

Inspect raw assertion
Field
observed_exploitation
Value
Microsoft .NET Framework Information Disclosure Vulnerability
Source dateFirst observed by CASCAOriginal evidence ↗
FIRST EPSSOriginal assertion
EPSS score

98.62% probability · 99.92th percentile

Inspect raw assertion
Field
model_probability
Value
Probability 0.986240000000; percentile 0.999190000000
Source dateFirst observed by CASCAOriginal evidence ↗

Applicability

Cited product scope

Trace impact →
51Underlying assertions
15Canonical products
18Target assertions
33Constraint assertions

Grouped from 18 configuration nodes in this exact snapshot. Visual grouping is navigational; asset exposure and root cause require cited evidence.

Identity source boundaries
  • Cpe dictionary1,775,266 records · observed through 2026-07-21T06:45:29.809Z27d65b0f-b718-4b4f-bb79-c47c68d09dfa
  • Cpe match643,502 records · observed through 2026-07-21T08:13:17.697Z955dae73-7302-438b-aee1-058d7cc5d48e

26 scope groups

microsoft · source assertedMicrosoftMicrosoft .NET Framework 2.0 Service Pack 2Direct source scope
Affected: 2.0.0 to before 3.0.50727.8976 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "2.0.0", "lessThan": "3.0.50727.8976", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.0 Service Pack 2Direct source scope
Affected: 3.0.0 to before 3.0.50727.8976 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "3.0.0", "lessThan": "3.0.50727.8976", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.5Direct source scope
Affected: 3.5.0 to before 3.0.50727.8976 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "3.5.0", "lessThan": "3.0.50727.8976", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.5.1Direct source scope
Affected: 3.5.0 to before 3.0.30729.8959 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "3.5.0", "lessThan": "3.0.30729.8959", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.5 AND 4.6/4.6.2Direct source scope
Affected: 10.0.0 to before 10.0.10240.20402 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "10.0.0", "lessThan": "10.0.10240.20402", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.5 AND 4.7.2Direct source scope
Affected: 4.7.0 to before 4.7.04081.03 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.7.0", "lessThan": "4.7.04081.03", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.5 AND 4.8Direct source scope
Affected: 4.8.0 to before 4.8.04690.02 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.8.0", "lessThan": "4.8.04690.02", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 3.5 AND 4.8.1Direct source scope
Affected: 4.8.1 to before 4.8.09214.01 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.8.1", "lessThan": "4.8.09214.01", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 4.6.2Direct source scope
Affected: 4.7.0 to before 4.7.04081.03 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.7.0", "lessThan": "4.7.04081.03", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2Direct source scope
Affected: 4.7.0 to before 4.7.04081.03 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.7.0", "lessThan": "4.7.04081.03", "versionType": "custom"}]
microsoft · source assertedMicrosoftMicrosoft .NET Framework 4.8Direct source scope
Affected: 4.8.0 to before 4.8.04690.02 (custom comparison)
Source-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Inspect raw assertion[{"status": "affected", "version": "4.8.0", "lessThan": "4.8.04690.02", "versionType": "custom"}]
NVD CPE · APPLICATIONmicrosoft.net_frameworkVulnerable target · 18 assertions
Version 2.0; Version 3.0; Version 3.5; Version 3.5.1; Version 4.6; Version 4.6.2; Version 4.7; Version 4.7.1; Version 4.7.2; Version 4.8; Version 4.8.1Canonical identity product-c3f13a19428f1ba85d60b6a58ac8c4637007c76c19683b493bea98fadd835759Linked exact
Scope supported
Inspect raw assertions
  1. cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23317443-1968-4791-9f20-ad3b308a83d1
  2. cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    7 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a16ad2b0-2189-4e8e-b7fc-ce598ca1cb2d
  3. cpe:2.3:a:microsoft:.net_framework:4.8.1:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    934d4e46-12c1-41dc-a28c-a2c430e965e4
  4. cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2d3f18af-84ed-473b-a8df-65eb23c475af
  5. cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    42a6df09-b8e1-414d-97e7-453566055279
  6. cpe:2.3:a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    3 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d400e856-2b2e-4cea-8ca5-309fdf371cea
  7. cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    6 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23317443-1968-4791-9f20-ad3b308a83d1
  8. cpe:2.3:a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    7 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    36b0e40a-84ef-4099-a395-75d6b8cda196
  9. cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3ef7a75e-ee27-4aa7-8d84-9d696728a4ce
  10. cpe:2.3:a:microsoft:.net_framework:4.8:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    8 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2d3f18af-84ed-473b-a8df-65eb23c475af
  11. cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a16ad2b0-2189-4e8e-b7fc-ce598ca1cb2d
  12. cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    2 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    8edc4407-7e92-4e60-82f0-0c87d1860d3a
  13. cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    0 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23317443-1968-4791-9f20-ad3b308a83d1
  14. cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    5 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a16ad2b0-2189-4e8e-b7fc-ce598ca1cb2d
  15. cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    4 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    280fe663-23be-45d2-9b31-5f577e390b48
  16. cpe:2.3:a:microsoft:.net_framework:3.5:-:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    1 · node/0 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    23317443-1968-4791-9f20-ad3b308a83d1
  17. cpe:2.3:a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    7 · node/0 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    3ef7a75e-ee27-4aa7-8d84-9d696728a4ce
  18. cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Vulnerable target
    Configuration
    7 · node/0 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    734112b3-1383-4be3-8721-c0f84566b764
NVD CPE · OPERATING SYSTEMmicrosoftwindows_10_1507Environmental constraint · 2 assertions
Version not applicableCanonical identity product-9851bd571b8ab08bca589cd73710badfef557d036f0fb7707f694f1c9f597cb4Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x86:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    4 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    28a7fee9-b473-48a0-b0ed-a5cc1e44194c
  2. cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    4 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a045ac0a-471e-444c-b3b0-4cabc23e8cfb
NVD CPE · OPERATING SYSTEMmicrosoftwindows_10_1607Environmental constraint · 3 assertions
Version not applicableCanonical identity product-740fec3e9838b5eabe76ebe27e4d0d7a4cb2e0ef7e13923300d3d0b51e3fce1cLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    61019899-d7af-46e4-a72c-d189180f66ab
  2. cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    61019899-d7af-46e4-a72c-d189180f66ab
  3. cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    61019899-d7af-46e4-a72c-d189180f66ab
NVD CPE · OPERATING SYSTEMmicrosoftwindows_10_1809Environmental constraint · 2 assertions
Version not applicableCanonical identity product-a3084138383423221f61594e86f5b295e5e254acd7ae5284f45e0877a084db43Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:x64:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    306b7ce6-8239-4aed-9ed4-4c9f5b349f58
  2. cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2e332666-2e03-468e-bc30-299816d6e8ed
NVD CPE · OPERATING SYSTEMmicrosoftwindows_10_21h2Environmental constraint · 2 assertions
Version not applicableCanonical identity product-ec10c9f400f23fdf118887f60fe116ffde4adb76dcf118cdd3a7556fd033da3bLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2f513002-d8c1-4d3a-9f79-4b52498f67e9
  2. cpe:2.3:o:microsoft:windows_10_21h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    2f513002-d8c1-4d3a-9f79-4b52498f67e9
NVD CPE · OPERATING SYSTEMmicrosoftwindows_10_22h2Environmental constraint · 2 assertions
Version not applicableCanonical identity product-a6295b9daad3ca57ce70751badba5b7fe99229c8a562cc7400e8cfef3daccaeeLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4d8dc08d-a860-493a-8aa6-1ad4a0a511ad
  2. cpe:2.3:o:microsoft:windows_10_22h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    4d8dc08d-a860-493a-8aa6-1ad4a0a511ad
NVD CPE · OPERATING SYSTEMmicrosoftwindows_11_21h2Environmental constraint · 2 assertions
Version not applicableCanonical identity product-7fe28b5b5b17e017d9554204df059dd619746ffb5c80da87bcbfb1c52720d2f4Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bb4ae761-6fac-4000-a63d-42ce3fab8412
  2. cpe:2.3:o:microsoft:windows_11_21h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    bb4ae761-6fac-4000-a63d-42ce3fab8412
NVD CPE · OPERATING SYSTEMmicrosoftwindows_11_22h2Environmental constraint · 1 assertions
Version not applicableCanonical identity product-f8c509b6ec25f2a4338a23556be321da5a7c3e8da9f1a4c52f7f15dd0e9a0d2aLinked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:o:microsoft:windows_11_22h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    d4793bfb-2e4e-4067-87a5-4b8749025ca3
NVD CPE · OPERATING SYSTEMmicrosoftwindows_11_23h2Environmental constraint · 1 assertions
Version not applicableCanonical identity product-026201767813843a6d53867bacde4a55c3035cb868c0a72434012c5e30dab148Linked exact
Scope constrained
Inspect raw assertion
  1. cpe:2.3:o:microsoft:windows_11_23h2:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    42d329b2-432d-4029-87eb-4c3c5f55cd95
NVD CPE · OPERATING SYSTEMmicrosoftwindows_server_2008Environmental constraint · 5 assertions
Version not applicable; Version r2Canonical identity product-217b1ab3d25f361a639824f86753d418b35aa2a816ee370bb71b5d1dd883d87aLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    af07a81d-12e5-4b1d-bff9-c8d08c32ff4f
  2. cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    2 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    af07a81d-12e5-4b1d-bff9-c8d08c32ff4f
  3. cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    3 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5f422a8c-2c4e-42c8-b420-e0728037e15c
  4. cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    5 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    5f422a8c-2c4e-42c8-b420-e0728037e15c
  5. cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    7 · node/1 · match 0
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    af07a81d-12e5-4b1d-bff9-c8d08c32ff4f
NVD CPE · OPERATING SYSTEMmicrosoftwindows_server_2012Environmental constraint · 6 assertions
Version not applicable; Version r2Canonical identity product-5a80416e92fed0cddbb3d4f3840218b448dee11159824ad25a0353da566963feLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    2 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a7df96f8-ba6a-4780-9ca3-f719b3f81074
  2. cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    db18c4ce-5917-401e-acf7-2747084fd36e
  3. cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a7df96f8-ba6a-4780-9ca3-f719b3f81074
  4. cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    7 · node/1 · match 1
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    a7df96f8-ba6a-4780-9ca3-f719b3f81074
  5. cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    2 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    db18c4ce-5917-401e-acf7-2747084fd36e
  6. cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    7 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    db18c4ce-5917-401e-acf7-2747084fd36e
NVD CPE · OPERATING SYSTEMmicrosoftwindows_server_2016Environmental constraint · 2 assertions
Version not applicableCanonical identity product-02e254d111ce604757a15650ef469f4f8365d6247da82ce3ac2695c3cfc7dc5fLinked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    8 · node/1 · match 4
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    041ff8ba-0b12-4a1f-b4bf-9c4f33b7c1e7
  2. cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 2
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    041ff8ba-0b12-4a1f-b4bf-9c4f33b7c1e7
NVD CPE · OPERATING SYSTEMmicrosoftwindows_server_2019Environmental constraint · 2 assertions
Version not applicableCanonical identity product-25a2932c0bbcb648f7e391c8b9d34c734e5085444c03c1c206b9d4c4baa80b25Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    0 · node/1 · match 3
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    db79ee26-fc32-417d-a49c-a1a63165a968
  2. cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    db79ee26-fc32-417d-a49c-a1a63165a968
NVD CPE · OPERATING SYSTEMmicrosoftwindows_server_2022Environmental constraint · 2 assertions
Version not applicableCanonical identity product-d196d31962e613955a91e33e795c22dcfa7bf25173abebaca616a6350cce9ce1Linked exact
Scope constrained
Inspect raw assertions
  1. cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    6 · node/1 · match 5
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    821614dd-37dd-44e2-a8a4-fe8d23a33c3c
  2. cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*
    Official link
    Linked exact
    Role
    Environmental constraint
    Configuration
    1 · node/1 · match 6
    Logic
    OR
    Version bounds
    No explicit bounds
    Match ID
    821614dd-37dd-44e2-a8a4-fe8d23a33c3c

Affected-product evidence

Accepted scope and product mapping

1 canonical links · 1 source-reported links

Mapping establishedEvidence supported

vendor-01299a5a765aea70faa05f2d06e0c26a5d498fd34553e868d89e8a43b31864db · product-c3f13a19428f1ba85d60b6a58ac8c4637007c76c19683b493bea98fadd835759

Source class
Nvd cpe vulnerable target
Assertions
18
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
077ac5f9-0efe-4377-b142-e48060683b2213e664bd-4ea0-48f2-9cc5-31156f11c74c17b94d35-e193-40ef-aed6-e7e3952bb5091eae6810-ed7b-4d90-8649-1a0917f675e925e0a6e4-2d15-4dda-ba96-7ae24e07360744e15141-be49-4ebe-a3b7-2dcd37e234936444da92-bd68-467b-87da-7a6369aeb83964567d82-92b3-4600-af2e-2e804874dad6862b8c84-3b92-459f-90e4-48163a37b3858f3b2576-17cc-4e05-99b2-fbe207508de5a4ca7bc7-2cae-4210-b6c5-b39742405931b1f5510b-6bd7-456b-8064-86caa0da9961bae2e82f-675f-4d35-801a-af5b2084c43dcce2aa95-977f-436c-a06d-3e52a1c6a9cfda30de56-dbf4-4784-9fe3-79530c172f64dc4dd714-3806-49b5-b414-3b9c51b8567fe1f36c40-2672-4712-8948-470cb13c083cec00a1ba-95d9-4552-957c-a31a57232647
Source-reported scopeSource-reported scope

Canonical linkage remains open; the cited source assertion is retained below.

Vendor specified only by source · Product specified only by source

Source class
Direct cve affected
Assertions
11
Mapping revision
cpe23-exact-mapping-v1
Observed cutoff
Aug 27, 2026
Retained assertion IDs
15aa816e-9305-46c2-861d-f0bc942cf3fc2ec555de-f1bf-43a9-acbe-45b3180b991b58de9dbb-736e-40ef-989c-4f0083a7da12807b6853-c6c5-4853-bcc2-41de03757e368393f62c-cded-4973-8583-cea957aa23858d5c839f-7e69-445d-b14b-6e000ac0f35b99ee5891-3e0c-4998-8a92-8341ac01f009a5f2f360-a345-40ca-86cc-29031070308ac94fd8f2-6c42-4f31-9362-e6b2a670cfccf377be47-f712-41da-b2bc-b3b265d1284afb602b01-dcad-42b3-bdb9-dc78edb7ef29

Assessments

CVSS by origin

7.5
secure@microsoft.comCVSS 3.1 · role Secondary · priority eligiblevalid_matchCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5
microsoftCVSS 3.1 · role unknown · display onlyDirect record assessment retained outside normalized eligibilityCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Direct CVE/CNA normalized decisions

7.5Priority eligible

microsoft

CVSS 3.1 · Primary · Original assertion · rank 1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Validation
Valid match
Recomputed
7.5
Decision reason
Evidence supported
Policy
casca-direct-cvss-eligibility-v1

Assessments are retained side by side under closed precedence. Cascade never averages CVSS.

Evidence boundaries

  • KEV membership is authoritative for the catalog, not proof of exposure in any environment.
  • EPSS is a dated model probability and not an individual-environment prediction.
  • Affected or fixed status applies only to the exact cited product and version scope; remaining scope stays source-scoped.
  • NVD-carried upstream facts remain derivative; independent corroboration requires a separately authored source.
  • Only NVD metrics validated under the generation-bound calculator are Public Priority eligible; direct CVE record metrics remain display-only.
  • NVD CVSS source eligibility is closed: NVD-authored, exact record-source, or registered same-CVE container origin; unmapped sources remain display-only.
  • Core replay supports the active and immediately prior generation; retrospective valid-at replay is deferred.
  • OSV aggregation and OSV-converted NVD material are not independent corroboration.
  • Red Hat facts are vendor assertions for the exact supplied products.
  • Nonmembership and not-yet-observed states are not proof of safety.