PatchaPalooza

CVE-2026-109481: ASP.NET Core Elevation of Privilege Vulnerability

CVE-2026-109481 is an elevation of privilege vulnerability in ASP.NET Core, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 4 products in 1 product family (Developer Tools).

Key facts

CVE ID
CVE-2026-109481
Severity
High CVSS 7.5
Microsoft severity
Important
Impact
Elevation of Privilege
Exploited in the wild
No
Publicly disclosed
No
Exploitation likelihood
Less Likely
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
November 2026 Patch Tuesday
Product families
Developer Tools

CVSS score and vector

Microsoft scores CVE-2026-109481 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

MetricValue
Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionRequired
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit code maturityUnproven
Remediation levelOfficial fix
Report confidenceConfirmed

Description

Cross-site request forgery (csrf) in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network.

Affected products (4)

Developer Tools

ProductSecurity updateTypeFixed buildRestart
.NET 11.0 installed on WindowsRelease NotesSecurity Update11.0.0
.NET 11.0 installed on LinuxRelease NotesSecurity Update11.0.0
.NET 11.0 installed on Mac OSRelease NotesSecurity Update11.0.0
Microsoft Visual Studio 2026 version 18.12Release NotesSecurity Update18.12.0

Acknowledgments

Revision history

VersionDateDescription
1.0Information published.

Sources