CVE-2026-118740: Aspire Security Feature Bypass Vulnerability
CVE-2026-118740 is a security feature bypass vulnerability in Aspire, rated Important by Microsoft, with a CVSS 3.1 base score of 9.1 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 2 products in 1 product family (Other).
Key facts
- CVE ID
- CVE-2026-118740
- Severity
- Critical CVSS 9.1
- Microsoft severity
- Important
- Impact
- Security Feature Bypass
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Other
From the November 2026 Patch Tuesday briefing
Aspire authorization bypass
This critical Aspire security feature bypass is reachable over the network without sign-in or user action. Application owners should explicitly check Aspire applicability rather than assume Windows deployment covers it. Microsoft rates exploitation less likely. The weakness is CWE-862, missing authorization. CVSS: 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-118740 at 9.1 (temporal 7.9) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
Frequently asked questions (Microsoft)
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The authentication feature could be bypassed as this vulnerability allows impersonation.
How could an attacker exploit this vulnerability?
An unauthenticated attacker with network access to an affected dashboard could send specially crafted requests to bypass authentication. Successful exploitation could allow the attacker to access sensitive information and modify or delete telemetry data. User interaction is not required.
Affected products (2)
Other
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Aspire Dashboard | Release Notes | Security Update | 13.6.5 | |
| Aspire.Dashboard.Sdk.linux-x64 on Linux | Release Notes | Security Update | 13.6.5 |
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |