CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

State: Published
Severity: 7.8 High
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Oct 20, 2026

Description

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	microsoft

Weaknesses

CWE-276 Incorrect Default Permissions

Affected Products

Product	Versions
.NET 10.0 installed on LinuxMicrosoft	10.0.0 to before 10.0.403Affected
.NET 10.0 installed on Mac OSMicrosoft	10.0.0 to before 10.0.403Affected
.NET 10.0 installed on WindowsMicrosoft	10.0.0 to before 10.0.403Affected
.NET 11.0 installed on LinuxMicrosoft	11.0.0-preview.1 to before 11.0.100-rc.3Affected
.NET 11.0 installed on Mac OSMicrosoft	11.0.0-preview.1 to before 11.0.100-rc.3Affected
.NET 11.0 installed on WindowsMicrosoft	11.0.0-preview.1 to before 11.0.100-rc.3Affected
.NET 8.0 installed on LinuxMicrosoft	8.0.0 to before 8.0.427Affected
.NET 8.0 installed on Mac OSMicrosoft	8.0.0 to before 8.0.427Affected
.NET 8.0 installed on WindowsMicrosoft	8.0.0 to before 8.0.427Affected
.NET 9.0 installed on LinuxMicrosoft	9.0.0 to before 9.0.320Affected
.NET 9.0 installed on Mac OSMicrosoft	9.0.0 to before 9.0.320Affected
.NET 9.0 installed on WindowsMicrosoft	9.0.0 to before 9.0.320Affected
.NET source-build Linux tarballs (all archive types)Microsoft	8.0.100 to before 10.0.403-servicing.26523.112Affected
ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)Microsoft	8.0.0 to before 9.0.22Affected

References

ASP.NET Core Elevation of Privilege Vulnerabilityvendor-advisorypatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.