Microsoft has patched a critical vulnerability in ASP.NET Core that earned a CVSS severity score of 9.9, the highest rating the company has ever assigned to a flaw in the web development framework.