CVE-2026-114155: .NET Elevation of Privilege Vulnerability
Published Nov 10, 2026
·Updated
.NET Elevation of Privilege Vulnerability
Other sources
Time-of-check time-of-use (toctou) race condition in .NET allows an authorized attacker to elevate privileges locally.
— Microsoft
Affected Software
9 affected componentsFixes available
All of the following
Microsoft .NET>=10.0<10.0.404
10.0.404
Apple macOS*
All of the following
Microsoft .NET>=11.0<11.0.100
11.0.100
Linux Linux*
Microsoft Microsoft.DotNet.HotReload.Watch.Aspire<11.0.100
11.0.100
All of the following
Microsoft .NET>=11.0<11.0.100
11.0.100
Apple macOS*
All of the following
Microsoft .NET>=10.0<10.0.404
10.0.404
Linux Linux*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.404Patch KB5135241 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.100
Event History
Nov 10, 2026
CVE Published
via Microsoft·04:00 PM
Data Sourced
via Microsoft·04:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·06:19 PM
Data Sourced
via MITRE·06:19 PM
DescriptionSeverity
Data Sourced
via NVD·07:19 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access and conditions does an attacker need to exploit this issue?
The attacker must already be authorized on the affected system and exploit the issue locally. The vector indicates high attack complexity and requires user interaction.
2
What is the potential impact after successful exploitation?
The severity vector indicates high impact to confidentiality, integrity, and availability, with scope changed. Successful exploitation can allow local privilege elevation.