Search threats, CVEs… ⌘K
Back to vendor advisories
Microsoft Security Response CenterCVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

High 1 CVE Published Oct 25, 2026 at 7:00 AM UTC
Get alerts for NET 8.0 installed on Windows

Summary

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Products covered

  • .NET 8.0 installed on Windows

  • .NET 8.0 installed on Linux

  • .NET 8.0 installed on Mac OS

  • .NET 9.0 installed on Windows

  • .NET 9.0 installed on Linux

  • .NET 9.0 installed on Mac OS

  • .NET 10.0 installed on Windows

  • .NET 10.0 installed on Linux

Show 6 more products

  • .NET 10.0 installed on Mac OS

  • .NET 11.0 installed on Windows

  • .NET 11.0 installed on Linux

  • .NET 11.0 installed on Mac OS

  • ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)

  • .NET source-build Linux tarballs (all archive types)

Remediation

Release Notes Install KB5133964. Install KB5133965. Install KB5133966.

Vendor-listed fixes

  • 8.0.427

  • 9.0.320

  • 10.0.403

  • 11.0.100-rc.3

  • 9.0.22

  • 10.0.403-servicing.26523.112

CVEs in this advisory 1

CVE-2026-114148

Updates

  1. Published by Microsoft Security Response Center

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

Keep investigating
See every advisory from this vendor