CVE-2026-114146: ASP.NET Core Elevation of Privilege Vulnerability
ASP.NET Core Elevation of Privilege Vulnerability
Other sources
Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.45 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.23Patch KB5135242 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.34Patch KB5135243 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.15Patch KB5135241 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.2.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.4
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be authorized, meaning they need some authenticated or otherwise authorized access to the affected ASP.NET Core application. Exploitation can be performed over a network and does not require the attacker to be physically local.
Does exploitation require user interaction or special conditions?
User interaction is required. The available data does not identify the specific interaction needed or the application configuration that makes exploitation possible.
What is the potential impact if exploitation succeeds?
A successful attacker can elevate privileges. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability, including impact beyond the original security authority.