---
id: CVE-2021-43877
title: ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
summary: ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'
cvssSource: cna
vendor: Microsoft
product: Microsoft Visual Studio 2019 version 16.7 (includes 16.0 – 16.6)
affected:
  - visual_studio_2019_version_16.7_includes_16.0_16.6 >= 16.0.0 < 16.7.23
  - visual_studio_2019_version_16.9_includes_16.0_-_16.8 >= 15.0.0 < 16.9.15
  - visual_studio_2019_version_16.11_includes_16.0_-_16.10 >= 16.11.0 < 16.11.8
  - visual_studio_2022_version_17.0 >= 17.0.0 < 17.0.3
  - asp.net_core_3.1 >= 3.0 < 3.1.22
  - asp.net_core_5.0 >= 5.0 < 5.0.13
  - asp.net_core_6.0 >= 6.0 < 6.0.101
  - visual_studio_2022_version_17.1 >= 17.0.0 < 17.1.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T21:01:44.367867Z'
published: '2021-12-15'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T18:14:55.026Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2021-43877'
references:
  - url: >-
      https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43877
tags:
  - cve.org
epss: 0.00733
epssPercentile: 0.5464
ingestedAt: '2026-11-05T19:30:42.770Z'
---

## Overview

ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability

## Affected

- `visual_studio_2019_version_16.7_includes_16.0_16.6 >= 16.0.0 < 16.7.23`
- `visual_studio_2019_version_16.9_includes_16.0_-_16.8 >= 15.0.0 < 16.9.15`
- `visual_studio_2019_version_16.11_includes_16.0_-_16.10 >= 16.11.0 < 16.11.8`
- `visual_studio_2022_version_17.0 >= 17.0.0 < 17.0.3`
- `asp.net_core_3.1 >= 3.0 < 3.1.22`
- `asp.net_core_5.0 >= 5.0 < 5.0.13`
- `asp.net_core_6.0 >= 6.0 < 6.0.101`
- `visual_studio_2022_version_17.1 >= 17.0.0 < 17.1.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.