CVE-2018-8360 — An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0, Microsoft .NET Framework 4.6/4.6.1/4.6.2

Back Back to CVE browser

HIGH

An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0, Microsoft .NET Framework 4.6/4.6.1/4.6.2

Published Aug 15, 2018

7.5

HIGH

CVSS 3.0

EPSS 8.97%

Description

An information disclosure vulnerability exists in Microsoft .NET Framework that could allow an attacker to access information in multi-tenant environments, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.0, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 4.7.2, Microsoft .NET Framework 2.0, Microsoft .NET Framework 4.6/4.6.1/4.6.2.

Affected products

Vendor Microsoft Product Microsoft .NET Framework Default
n/a
- Version
  2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1607 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1607 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1703 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1703 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1709 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1709 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1803 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 Version 1803 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 10 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 8.1 for 32-bit systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows 8.1 for x64-based systems
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server 2012
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server 2012 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server 2012 R2
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server 2012 R2 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server 2016
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server 2016 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server, version 1709 (Server Core Installation)
  Status
  affected
  Constraints
  -
- Version
  3.5 on Windows Server, version 1803 (Server Core Installation)
  Status
  affected
  Constraints
  -
- Version
  3.5.1 on Windows 7 for 32-bit Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  3.5.1 on Windows 7 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows 7 for 32-bit Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows 7 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows 8.1 for 32-bit systems
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows 8.1 for x64-based systems
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows RT 8.1
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2012
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2012 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2012 R2
  Status
  affected
  Constraints
  -
- Version
  4.5.2 on Windows Server 2012 R2 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016
  Status
  affected
  Constraints
  -
- Version
  4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 7 for 32-bit Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 7 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 8.1 for 32-bit systems
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 8.1 for x64-based systems
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows RT 8.1
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012 R2
  Status
  affected
  Constraints
  -
- Version
  4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012 R2 (Server Core installation)
  Status
  affected
  Constraints
  -
- Version
  4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  4.7.1/4.7.2 on Windows Server, version 1709 (Server Core Installation)
  Status
  affected
  Constraints
  -
- Version
  4.7.2 on Windows 10 Version 1803 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  4.7.2 on Windows 10 Version 1803 for x64-based Systems
  Status
  affected
  Constraints
  -
- Version
  4.7.2 on Windows Server, version 1803 (Server Core Installation)
  Status
  affected
  Constraints
  -
- Version
  4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for 32-bit Systems
  Status
  affected
  Constraints
  -
- Version
  4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for x64-based Systems
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

Microsoft .NET Framework

n/a

Version	Status	Constraints
2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2	affected	-
2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2	affected	-
2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2	affected	-
3.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2	affected	-
3.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2	affected	-
3.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2	affected	-
3.5 on Windows 10 Version 1607 for 32-bit Systems	affected	-
3.5 on Windows 10 Version 1607 for x64-based Systems	affected	-
3.5 on Windows 10 Version 1703 for 32-bit Systems	affected	-
3.5 on Windows 10 Version 1703 for x64-based Systems	affected	-
3.5 on Windows 10 Version 1709 for 32-bit Systems	affected	-
3.5 on Windows 10 Version 1709 for x64-based Systems	affected	-
3.5 on Windows 10 Version 1803 for 32-bit Systems	affected	-
3.5 on Windows 10 Version 1803 for x64-based Systems	affected	-
3.5 on Windows 10 for 32-bit Systems	affected	-
3.5 on Windows 10 for x64-based Systems	affected	-
3.5 on Windows 8.1 for 32-bit systems	affected	-
3.5 on Windows 8.1 for x64-based systems	affected	-
3.5 on Windows Server 2012	affected	-
3.5 on Windows Server 2012 (Server Core installation)	affected	-
3.5 on Windows Server 2012 R2	affected	-
3.5 on Windows Server 2012 R2 (Server Core installation)	affected	-
3.5 on Windows Server 2016	affected	-
3.5 on Windows Server 2016 (Server Core installation)	affected	-
3.5 on Windows Server, version 1709 (Server Core Installation)	affected	-
3.5 on Windows Server, version 1803 (Server Core Installation)	affected	-
3.5.1 on Windows 7 for 32-bit Systems Service Pack 1	affected	-
3.5.1 on Windows 7 for x64-based Systems Service Pack 1	affected	-
3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1	affected	-
3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1	affected	-
3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	affected	-
4.5.2 on Windows 7 for 32-bit Systems Service Pack 1	affected	-
4.5.2 on Windows 7 for x64-based Systems Service Pack 1	affected	-
4.5.2 on Windows 8.1 for 32-bit systems	affected	-
4.5.2 on Windows 8.1 for x64-based systems	affected	-
4.5.2 on Windows RT 8.1	affected	-
4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1	affected	-
4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	affected	-
4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2	affected	-
4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2	affected	-
4.5.2 on Windows Server 2012	affected	-
4.5.2 on Windows Server 2012 (Server Core installation)	affected	-
4.5.2 on Windows Server 2012 R2	affected	-
4.5.2 on Windows Server 2012 R2 (Server Core installation)	affected	-
4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems	affected	-
4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems	affected	-
4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016	affected	-
4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)	affected	-
4.6/4.6.1/4.6.2 on Windows 10 for 32-bit Systems	affected	-
4.6/4.6.1/4.6.2 on Windows 10 for x64-based Systems	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 7 for 32-bit Systems Service Pack 1	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 7 for x64-based Systems Service Pack 1	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 8.1 for 32-bit systems	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows 8.1 for x64-based systems	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows RT 8.1	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012 (Server Core installation)	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012 R2	affected	-
4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 on Windows Server 2012 R2 (Server Core installation)	affected	-
4.7.1/4.7.2 on Windows 10 Version 1709 for 32-bit Systems	affected	-
4.7.1/4.7.2 on Windows 10 Version 1709 for x64-based Systems	affected	-
4.7.1/4.7.2 on Windows Server, version 1709 (Server Core Installation)	affected	-
4.7.2 on Windows 10 Version 1803 for 32-bit Systems	affected	-
4.7.2 on Windows 10 Version 1803 for x64-based Systems	affected	-
4.7.2 on Windows Server, version 1803 (Server Core Installation)	affected	-
4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for 32-bit Systems	affected	-
4.7/4.7.1/4.7.2 on Windows 10 Version 1703 for x64-based Systems	affected	-

Remediation

No remediation recorded yet.

Metrics

8.97% 0.08972

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.08972

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (39 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	8.97% (0.08972)	95.11th	v5 (v2026.06.15)
Sep 22, 2026	8.97% (0.08972)	95.02th	v5 (v2026.06.15)
Sep 21, 2026	7.66% (0.07655)	94.40th	v5 (v2026.06.15)
Sep 6, 2026	8.97% (0.08972)	94.91th	v5 (v2026.06.15)
Sep 5, 2026	7.66% (0.07655)	94.27th	v5 (v2026.06.15)
Aug 30, 2026	8.97% (0.08972)	94.88th	v5 (v2026.06.15)
Aug 28, 2026	7.66% (0.07655)	94.23th	v5 (v2026.06.15)
Aug 24, 2026	8.97% (0.08972)	94.85th	v5 (v2026.06.15)
Aug 23, 2026	7.66% (0.07655)	94.21th	v5 (v2026.06.15)
Jun 15, 2026	8.97% (0.08972)	94.58th	v5 (v2026.06.15)
May 7, 2026	18.00% (0.18002)	95.20th	v4 (v2025.03.14)
Mar 13, 2026	13.58% (0.13581)	94.11th	v4 (v2025.03.14)
Mar 3, 2026	10.39% (0.10393)	93.12th	v4 (v2025.03.14)
Jan 31, 2026	8.49% (0.08488)	92.13th	v4 (v2025.03.14)
Dec 7, 2025	9.82% (0.09824)	92.68th	v4 (v2025.03.14)
Nov 21, 2025	7.48% (0.07481)	91.39th	v4 (v2025.03.14)
Nov 18, 2025	10.43% (0.10428)	92.46th	v4 (v2025.03.14)
Aug 9, 2025	7.48% (0.07481)	91.37th	v4 (v2025.03.14)
Mar 30, 2025	4.52% (0.04522)	88.11th	v4 (v2025.03.14)
Mar 29, 2025	16.50% (0.16500)	91.52th	v4 (v2025.03.14)
Mar 19, 2025	3.13% (0.03126)	85.36th	v4 (v2025.03.14)
Mar 17, 2025	8.02% (0.08018)	91.48th	v4 (v2025.03.14)
Dec 12, 2024	1.61% (0.01608)	87.94th	v3 (v2023.03.01)
May 30, 2024	2.26% (0.02262)	89.59th	v3 (v2023.03.01)
Feb 15, 2024	2.68% (0.02680)	90.09th	v3 (v2023.03.01)
Jan 27, 2024	2.54% (0.02543)	89.12th	v3 (v2023.03.01)
Jan 6, 2024	2.66% (0.02661)	89.31th	v3 (v2023.03.01)
Dec 15, 2023	2.97% (0.02973)	89.82th	v3 (v2023.03.01)
Nov 24, 2023	5.76% (0.05765)	92.57th	v3 (v2023.03.01)
Sep 13, 2023	6.49% (0.06491)	92.84th	v3 (v2023.03.01)
Sep 3, 2023	6.58% (0.06583)	92.87th	v3 (v2023.03.01)
Jul 25, 2023	6.49% (0.06494)	92.75th	v3 (v2023.03.01)
Mar 7, 2023	4.93% (0.04935)	91.54th	v3 (v2023.03.01)
Mar 6, 2023	6.42% (0.06416)	91.03th	v2 (v2022.01.01)
Dec 6, 2022	6.42% (0.06416)	90.75th	v2 (v2022.01.01)
May 22, 2022	5.27% (0.05274)	88.93th	v2 (v2022.01.01)
Feb 4, 2022	4.00% (0.04004)	67.82th	v2 (v2022.01.01)
Feb 3, 2022	8.76% (0.08756)	86.41th	v5 (v2026.06.15)
Apr 14, 2021	8.76% (0.08756)	0.00th	v1

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

http://www.securityfocus.com/bid/104986
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041462
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8360
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/104986		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041462		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8360		x_refsource_CONFIRMPatchVendor Advisory