ASP.NET Core: Security feature bypass via race condition

Summary

A race condition (CWE-362) in ASP.NET Core allows an authorized local attacker to elevate privileges. Microsoft's official title classifies the issue as a security feature bypass, while the CVE description and some third-party listings describe local privilege escalation. The attacker needs local access and low privileges, and exploiting the race condition is rated high complexity. Exposure is mainly on shared Windows hosts, build agents and developer workstations, not directly from the internet.

Affected

• Microsoft .NET 8.0 on Windows: 8.0.0 to before 8.0.34
• Microsoft .NET 9.0 on Windows: 9.0.0 to before 9.0.23
• Microsoft .NET 10.0 on Windows: 10.0.0 to before 10.0.15
• Microsoft .NET 11.0 on Windows: 11.0.0-preview.1 to before 11.0.0
• Microsoft Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.45
• Microsoft Visual Studio 2026 version 18.11: 18.11.0 to before 18.11.4
• Microsoft Visual Studio 2026 version 18.12: range listed as unreliable in the CVE record and aggregators
• Platform scope per CVE record: Windows. Third-party sources also list Linux and macOS for .NET 8 and 9; unconfirmed.

Fixed in

• .NET 8.0: 8.0.34 or later
• .NET 9.0: 9.0.23 or later
• .NET 10.0: 10.0.15 or later
• .NET 11.0: 11.0.0 or later
• Visual Studio 2022 17.14: 17.14.45 or later (per CVE record)
• Visual Studio 2026 18.11: 18.11.4 or later (per CVE record)
• Visual Studio 2026 18.12: fixed build unknown
• Patches released on 10 November 2026 with the .NET servicing updates. Verify versions against the Microsoft advisory before deployment.

Workaround

Unknown. No vendor workaround or mitigation has been identified.

Exploitation

• Not known to be exploited in the wild.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• Rapid7 rates it Exploitation Less Likely.
• No public proof of concept found; this does not prove none exists.

Our recommendation

• Inventory .NET 8, 9 and 10 runtimes and SDKs and Visual Studio 2026 on Windows hosts.
• Install the patched builds from the November 2026 servicing updates, prioritising multi-user servers, build agents and developer machines.
• Verify final version numbers in the Microsoft or GitHub advisory and NVD, as NVD was still awaiting analysis.
• Restrict local logon and code execution on shared hosts to trusted users.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-114157 msrc.microsoft.com
• CVE Record CVE-2026-114157 www.cve.org
• .NET and .NET Framework November 2026 servicing updates devblogs.microsoft.com
• .NET announcements issue 504 github.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• SANS ISC diary 33508 isc.sans.edu

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:47.