CVE-2026-114157: ASP.NET Core Security Feature Bypass Vulnerability

Q: What level of access does an attacker need to exploit this issue?

The attacker must already be authorized and have local access. The attack vector is local, requires low privileges, and does not require user interaction.

Q: How difficult is exploitation?

Exploitation has high attack complexity. The issue involves a race condition during concurrent use of a shared resource, so an attacker must successfully trigger the timing-dependent condition.

Q: What is the likely impact if exploitation succeeds?

A successful attack can elevate privileges and has high confidentiality and integrity impact. Availability impact is rated as none.

Published Nov 10, 2026

Updated

ASP.NET Core Security Feature Bypass Vulnerability

Other sources

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

— Microsoft

Affected Software

11 affected componentsFixes available

Microsoft Visual Studio 2026>=18.12<18.12.0

18.12.0

Microsoft Visual Studio 2022>=17.14<17.14.45

17.14.45

All of the following

Microsoft .NET>=11.0<11.0.0

11.0.0

Microsoft Windows*

All of the following

Microsoft .NET>=10.0<10.0.15

10.0.15

Microsoft Windows*

Microsoft Visual Studio 2026>=18.11<18.11.4

18.11.4

All of the following

Microsoft .NET>=9.0<9.0.23

9.0.23

Microsoft Windows*

All of the following

Microsoft .NET>=8.0<8.0.34

8.0.34

Microsoft Windows*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.12.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.14.45
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.0.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 9.0.23Patch KB5135242
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.15Patch KB5135241
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.11.4
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.0.34Patch KB5135243

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:19 PM

Data Sourced

via MITRE·06:19 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The attacker must already be authorized and have local access. The attack vector is local, requires low privileges, and does not require user interaction.

How difficult is exploitation?

Exploitation has high attack complexity. The issue involves a race condition during concurrent use of a shared resource, so an attacker must successfully trigger the timing-dependent condition.

What is the likely impact if exploitation succeeds?

A successful attack can elevate privileges and has high confidentiality and integrity impact. Availability impact is rated as none.

CVE-2026-114157: ASP.NET Core Security Feature Bypass Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

How difficult is exploitation?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

How difficult is exploitation?

What is the likely impact if exploitation succeeds?