CVE-2026-114148: ASP.NET Core Elevation of Privilege Vulnerability

Overview

Severity

N/A

Category

Elevation of Privilege

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-25

Description

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

FAQ

What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain the highest privileges on the system.

Affected Products (14)

Developer Tools

• .NET 8.0 installed on Windows
• .NET 8.0 installed on Linux
• .NET 8.0 installed on Mac OS
• .NET 9.0 installed on Windows
• .NET 9.0 installed on Linux
• .NET 9.0 installed on Mac OS
• .NET 10.0 installed on Windows
• .NET 10.0 installed on Linux
• .NET 10.0 installed on Mac OS
• .NET 11.0 installed on Windows
• .NET 11.0 installed on Linux
• .NET 11.0 installed on Mac OS
• ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)
• .NET source-build Linux tarballs (all archive types)

Security Updates (4)

• 5133964
• 5133965
• 5133966
• Release Notes

Acknowledgments

<a href="https://www.linkedin.com/in/alen-cheung/">Alen Cheung</a>

Revision History

• 2026-10-25: Information published.