CVE-2026-120006: Aspire Elevation of Privilege Vulnerability

Q: Who is realistically exposed to this issue?

Systems using Microsoft Aspire.Hosting or Microsoft Aspire.Hosting.AppHost are in scope. Exploitation is local and requires an authorized attacker, so remotely unauthenticated attackers are not described as able to exploit it.

Q: What does an attacker need to exploit the vulnerability?

The attacker needs local access, existing low-level privileges, and user interaction. The attack complexity is rated high, indicating additional conditions are required beyond simply having authorized local access.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can allow elevation of privilege and may affect confidentiality, integrity, and availability at a high level. The scope is changed, meaning the impact can extend beyond the initially affected security authority.

Published Nov 10, 2026

Updated

Aspire Elevation of Privilege Vulnerability

Other sources

Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.

— Microsoft

Affected Software

2 affected componentsFixes available

Microsoft Aspire.Hosting<13.6.5

13.6.5

Microsoft Aspire.Hosting.AppHost<13.6.5

13.6.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.6.5

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems using Microsoft Aspire.Hosting or Microsoft Aspire.Hosting.AppHost are in scope. Exploitation is local and requires an authorized attacker, so remotely unauthenticated attackers are not described as able to exploit it.

What does an attacker need to exploit the vulnerability?

The attacker needs local access, existing low-level privileges, and user interaction. The attack complexity is rated high, indicating additional conditions are required beyond simply having authorized local access.

What is the potential impact if exploitation succeeds?

Successful exploitation can allow elevation of privilege and may affect confidentiality, integrity, and availability at a high level. The scope is changed, meaning the impact can extend beyond the initially affected security authority.

CVE-2026-120006: Aspire Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

What is the potential impact if exploitation succeeds?