CVE-2026-120006: Aspire Elevation of Privilege Vulnerability
CVE-2026-120006 is an elevation of privilege vulnerability in Aspire, rated Important by Microsoft. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. Microsoft released the fix on 10 November 2026 in the November 2026 Patch Tuesday. It affects 2 products in 1 product family (Other).
Key facts
- CVE ID
- CVE-2026-120006
- Severity
- N/A
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2026 Patch Tuesday
- Product families
- Other
Description
Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally.
Affected products (2)
Other
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Aspire.Hosting.AppHost | Release Notes | Security Update | 13.6.5 | |
| Aspire.Hosting | Release Notes | Security Update | 13.6.5 |
Acknowledgments
- samthewhitehat
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |