CVE-2026-114148 PUBLISHED

ASP.NET Core Elevation of Privilege Vulnerability

Assigner: microsoft
Reserved: 20.10.2026 Published: 29.10.2026 Updated: 29.10.2026

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS Score: 7.8

CVSS 3.1

Vendor	Microsoft
Product	.NET 11.0 installed on Linux
Versions	affected from 11.0.0-preview.1 to 11.0.100-rc.3 (excl.)

Vendor	Microsoft
Product	.NET 11.0 installed on Mac OS
Versions	affected from 11.0.0-preview.1 to 11.0.100-rc.3 (excl.)

Vendor	Microsoft
Product	.NET 11.0 installed on Windows
Versions	affected from 11.0.0-preview.1 to 11.0.100-rc.3 (excl.)

Vendor	Microsoft
Product	.NET source-build Linux tarballs (all archive types)
Versions	affected from 8.0.100 to 10.0.403-servicing.26523.112 (excl.)

Vendor	Microsoft
Product	ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)
Versions	affected from 8.0.0 to 9.0.22 (excl.)