Microsoft ASP.NET Core: Elevation of privilege via incorrect authorization
Summary
ASP.NET Core contains an incorrect authorization flaw (CWE-863) that allows an authenticated attacker to elevate privileges over the network. The CVSS 3.1 score is 9.0 (critical), with a changed scope and high impact on confidentiality, integrity and availability. Exploitation requires a valid low-privilege account and some user interaction, so public websites without user logins face lower risk, while internal portals and multi-user web applications are more exposed.
Affected
- Microsoft .NET 8.0 on Linux, macOS and Windows: 8.0.0 to before 8.0.34
- Microsoft .NET 9.0 on Linux, macOS and Windows: 9.0.0 to before 9.0.23
- Microsoft .NET 10.0 on Linux, macOS and Windows: 10.0.0 to before 10.0.15
- Microsoft .NET 11.0 on Linux, macOS and Windows: 11.0.0-preview.1 to before 11.0.0
- Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.45
- Visual Studio 2026 version 18.11: 18.11.0 to before 18.11.4
- Visual Studio 2026 version 18.12: published range is empty (18.12.0 to before 18.12.0); verify in the advisory
Fixed in
- Per the CVE record, the first fixed versions are .NET 8.0.34, .NET 9.0.23, .NET 10.0.15 and .NET 11.0.0, and Visual Studio 17.14.45 and 18.11.4
- Visual Studio 2026 18.12: unknown
- Exact build numbers should be confirmed in the MSRC advisory before rollout
Workaround
No vendor workaround known. Apply the security update.
Exploitation
- No exploitation known at the time of publication.
- No public proof of concept or CISA KEV entry found in a limited search.
- The CVE was published on 10 November 2026 and is still awaiting NVD analysis.
Our recommendation
- Inventory all systems running ASP.NET Core or .NET, including IIS servers, Linux containers and vendor-supplied applications, and record their versions.
- Patch .NET 9, 10 and 11 and Visual Studio installations first, using the fixed versions listed above.
- Plan migration away from .NET 8, which reaches end of support on 10 November 2026 and will not receive this fix.
- Review custom authorization policies and role checks in your own ASP.NET Core applications, especially multi-user internal apps.
- Monitor for exploitation reports and vendor updates.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-114146 msrc.microsoft.com
- OSS-Eva: .NET 8 end of life www.osseva.io
- Windows Forum: .NET November 2026 updates windowsforum.com
- .NET Blog November 2026 servicing (mirror) rssfeedtelegrambot.bnaya.co.il
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:24.
Original description (NVD)
Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.