Aspire Dashboard: Security feature bypass due to missing authorization

Summary

Microsoft Aspire Dashboard and the Aspire.Dashboard.Sdk.linux-x64 component in versions 13.6.1 up to (but not including) 13.6.5 contain a missing authorization flaw (CWE-862). A remote, unauthenticated attacker can bypass a security feature over the network without user interaction, with high impact on confidentiality and integrity according to the CVSS vector (9.1, Critical, as provided). Practical risk is highest where Aspire components are reachable from untrusted networks.

Affected

• Microsoft Aspire Dashboard: 13.6.1 to < 13.6.5
• Microsoft Aspire.Dashboard.Sdk.linux-x64: 13.6.1 to < 13.6.5

Fixed in

• Version 13.6.5 or later (inferred from the affected range; confirm on the MSRC update guide)

Workaround

Unknown. No vendor guidance found at time of publication.

Exploitation

Unknown. No reports of exploitation in the wild or public proof of concept found at time of publication.

Our recommendation

• Identify all hosts running Aspire Dashboard or Aspire.Dashboard.Sdk components, including development, staging and production systems.
• Restrict network access to Aspire components so they are not reachable from untrusted networks until patched.
• Update affected components to 13.6.5 or later after confirming the fix on the MSRC update guide.
• Monitor the MSRC update guide and the NVD entry for further details and exploitation signals.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-118740 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:23.