.NET 7 STS, end of life since 14 May 2024
.NET 7 end of life
.NET 7 stopped receiving security fixes on 14 May 2024; its last release is 7.0.20. Microsoft no longer checks whether new vulnerabilities affect .NET 7, so its advisories, and the US National Vulnerability Database, stop listing it. Since that date Microsoft has fixed 70 vulnerabilities in .NET 8.
- 36vulnerabilities fixed while supported
- 1critical
- 28high
- 2exploited in the wild
What you can do
Keep .NET 7, patched
We backport the security fixes to .NET 7: the runtime, ASP.NET Core and the SDK, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to .NET 10, supported until 14 November 2028, if your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.
All 36 vulnerabilities Microsoft fixed in .NET 7
US National Vulnerability Database, 28 October 2026, highest score first: vulnerabilities in .NET and ASP.NET Core that affect .NET 7. Fixed in: the first .NET 7 release with the fix, where NVD records it. Exploited: listed in the CISA catalogue of known exploited vulnerabilities.
| CVE | Score | Severity | Published | Fixed in | Description |
|---|---|---|---|---|---|
| CVE-2024-0057 | 9.1 | Critical | 2024-01-09 | 7.0.15 | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2024-0056 | 8.7 | High | 2024-01-09 | 7.0.15 | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability |
| CVE-2023-33127 | 8.1 | High | 2023-07-11 | 7.0.9 | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-33170 | 8.1 | High | 2023-07-11 | 7.0.9 | ASP.NET and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2023-21808 | 7.8 | High | 2023-02-14 | n/a | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-24895 | 7.8 | High | 2023-06-14 | n/a | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-24897 | 7.8 | High | 2023-06-14 | n/a | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-28260 | 7.8 | High | 2023-04-11 | 7.0.5 | .NET DLL Hijacking Remote Code Execution Vulnerability |
| CVE-2023-35390 | 7.8 | High | 2023-08-08 | 7.0.10 | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36792 | 7.8 | High | 2023-09-12 | n/a | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36793 | 7.8 | High | 2023-09-12 | n/a | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36794 | 7.8 | High | 2023-09-12 | n/a | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36796 | 7.8 | High | 2023-09-12 | n/a | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36049 | 7.6 | High | 2023-11-14 | 7.0.14 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-24936 | 7.5 | High | 2023-06-14 | n/a | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-29331 | 7.5 | High | 2023-06-14 | n/a | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2023-36435 | 7.5 | High | 2023-10-10 | n/a | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-38171 | 7.5 | High | 2023-10-10 | 7.0.12 | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-38180 Exploited | 7.5 | High | 2023-08-08 | 7.0.10 | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2023-44487 Exploited | 7.5 | High | 2023-10-10 | 7.0.12 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| CVE-2024-20672 | 7.5 | High | 2024-01-09 | 7.0.15 | .NET Denial of Service Vulnerability |
| CVE-2024-21386 | 7.5 | High | 2024-02-13 | 7.0.16 | .NET Denial of Service Vulnerability |
| CVE-2024-21392 | 7.5 | High | 2024-03-12 | 7.0.17 | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-21404 | 7.5 | High | 2024-02-13 | 7.0.16 | .NET Denial of Service Vulnerability |
| CVE-2024-26190 | 7.5 | High | 2024-03-12 | 7.0.17 | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-33126 | 7.3 | High | 2023-06-14 | 7.0.7 | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-33128 | 7.3 | High | 2023-06-14 | 7.0.7 | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-33135 | 7.3 | High | 2023-06-14 | 7.0.7 | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2024-21409 | 7.3 | High | 2024-04-09 | 7.0.18 | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-21319 | 6.8 | Medium | 2024-01-09 | 7.0.15 | Microsoft Identity Denial of service vulnerability |
| CVE-2023-32032 | 6.5 | Medium | 2023-06-14 | 7.0.7 | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-36799 | 6.5 | Medium | 2023-09-12 | n/a | .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2024-30045 | 6.3 | Medium | 2024-05-14 | 7.0.19 | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-35391 | 6.2 | Medium | 2023-08-08 | 7.0.10 | ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability |
| CVE-2023-36558 | 6.2 | Medium | 2023-11-14 | 7.0.14 | ASP.NET Core Security Feature Bypass Vulnerability |
| CVE-2024-30046 | 5.9 | Medium | 2024-05-14 | 7.0.19 | Visual Studio Denial of Service Vulnerability |