CVE-2026-109481: ASP.NET Core Elevation of Privilege Vulnerability
Published Nov 10, 2026
·Updated
ASP.NET Core Elevation of Privilege Vulnerability
Other sources
Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
7 affected componentsFixes available
All of the following
Microsoft .NET>=11.0<11.0.0
11.0.0
Microsoft Windows*
All of the following
Microsoft .NET>=11.0<11.0.0
11.0.0
Apple macOS*
Microsoft Visual Studio 2026>=18.12<18.12.0
18.12.0
All of the following
Microsoft .NET>=11.0<11.0.0
11.0.0
Linux Linux*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0
Event History
Nov 10, 2026
CVE Published
via Microsoft·04:00 PM
Data Sourced
via Microsoft·04:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·04:00 PM
Affected Software
CVE Published
via MITRE·06:15 PM
Data Sourced
via MITRE·06:15 PM
DescriptionSeverity
Data Sourced
via NVD·07:18 PM
DescriptionSeverityWeakness