Elevation of Privilege Vulnerability in ASP.NET Core by Microsoft
CVE-2026-114148

7.8HIGH

Key Information:

Vendor

Microsoft
Status
.net 10.0 Installed On Linux
.net 10.0 Installed On Mac Os
.net 10.0 Installed On Windows
.net 11.0 Installed On Linux
Vendor
CVE Published:
29 October 2026

Badges

đź“° News Worthy

What is CVE-2026-114148?

A security flaw in ASP.NET Core allows authorized users to exploit incorrect default permissions, leading to potential local privilege escalation. This vulnerability poses a risk as it enables an attacker to gain higher-level access than intended, potentially compromising sensitive data and system integrity. It is crucial for users and organizations utilizing ASP.NET Core to apply the necessary patches promptly to mitigate this risk.

Affected Version(s)

.NET 10.0 installed on Linux 10.0.0 < 10.0.403

.NET 10.0 installed on Mac OS 10.0.0 < 10.0.403

.NET 10.0 installed on Windows 10.0.0 < 10.0.403

News Articles

favicon imageInfosecurity Magazine

Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overf

Microsoft’s updates address two newly disclosed vulnerabilities in the .NET developer platform, as well as flaws not fully addressed in an earlier release

6 days ago

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • đź“°

    First article discovered by Infosecurity Magazine

  • Vulnerability Reserved

.