Home November 2026 Patch Tuesday CVE-2026-118749 CVE-2026-118749: ASP.NET Core Denial of Service Vulnerability CVE-2026-118749 is a denial of service vulnerability in ASP.NET Core, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 5 products in 2 product families (Other, Developer Tools).
Key facts CVE ID CVE-2026-118749 Severity High CVSS 7.5Microsoft severity Important Impact Denial of Service Exploited in the wild No Publicly disclosed No Exploitation likelihood Less Likely Weakness CWE-407 CISA KEV Not listed Released 10 November 2026 Last updated 11 November 2026 Patch Tuesday November 2026 Patch Tuesday Product families Other , Developer Tools CVSS score and vector Microsoft scores CVE-2026-118749 at 7.5 (temporal 6.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Metric Value Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Unchanged Confidentiality impact None Integrity impact None Availability impact High Exploit code maturity Unproven Remediation level Official fix Report confidence Confirmed
Description Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Affected products (5) Other Product Security update Type Fixed build Restart Microsoft.Extensions.Validation Release Notes Security Update 11.0.0
Product Security update Type Fixed build Restart .NET 11.0 installed on Windows Release Notes Security Update 11.0.0 .NET 11.0 installed on Linux Release Notes Security Update 11.0.0 .NET 11.0 installed on Mac OS Release Notes Security Update 11.0.0 Microsoft Visual Studio 2026 version 18.12 Release Notes Security Update 18.12.0
NIST NVD data NVD status Awaiting Analysis NVD CVSS 7.5 (HIGH) NVD weakness CWE-407 Published to NVD 10 November 2026 NVD last modified 10 November 2026 References Revision history Version Date Description 1.0 10 November 2026 Information published. 2.0 11 November 2026 Changes made to the security updates links and information. This is an informational change only.
Patch Tuesday archive Data: Microsoft Security Response Center (MSRC) Security Update Guide, CISA Known Exploited Vulnerabilities catalog, FIRST EPSS, NIST National Vulnerability Database, VulnCheck, and public detection rule repositories (Nuclei, Sigma, YARA, Metasploit).
About PatchaPalooza · Feeds: new CVEs · risk changes · advisory updates