CVE-2026-114148: High severity Microsoft .NET 10.0 installed on Mac OS vulnerability
ASP.NET Core Elevation of Privilege Vulnerability
Other sources
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.100-rc.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.403Patch KB5133966 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.22Patch KB5133965 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.427Patch KB5133964 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.320Patch KB5133965
Event History
Frequently Asked Questions
Which environments should be prioritized for review?
Review systems with the listed Microsoft .NET installations: .NET 8.0 or 9.0 on macOS, .NET 9.0 or 11.0 on Windows, and .NET 10.0 or 11.0 on Linux. The provided data does not identify other platforms or .NET versions as affected.
What level of access does an attacker need?
An attacker must already be authorized and have local access to the affected system. No user interaction is required.
Does this depend on a custom permission configuration?
The vulnerability is attributed to incorrect default permissions in ASP.NET Core. This indicates that default permission behavior is relevant, rather than the issue being described as requiring a custom configuration.