ASP.NET Core: Elevation of privilege in scaffolding and project templates

Summary

Microsoft's ASP.NET Core developer tooling contains an elevation-of-privilege flaw rated CVSS 8.1 (CWE-640, weak password-recovery mechanism). The affected components are scaffolding tools and project templates that generate starter code, including user-account features, not the ASP.NET Core runtime. A remote attacker without privileges or user interaction could elevate privileges over the network, but the attack complexity is high. Applications already generated with the affected packages keep the flaw and must be regenerated after the update.

Affected

• Microsoft.dotnet-scaffold: 10.0.0 up to 20.3.0 (range as listed in the CVE record, not confirmed by a second source)
• Microsoft.dotnet-scaffold-aspnet: 9.0.0 up to 9.0.13
• Microsoft.DotNet.Web.ProjectTemplates.10.0: 10.0.13 up to 10.0.15
• Microsoft.DotNet.Web.ProjectTemplates.9.0: 9.0.21 up to 9.0.23
• Microsoft.DotNet.Web.ProjectTemplates.8.0: 8.0.32 up to 8.0.34
• Microsoft.VisualStudio.Web.CodeGeneration.Design and Microsoft.VisualStudio.Web.CodeGenerators.Mvc: affected versions not yet available in the CVE record, before 10.0.3

Fixed in

• Microsoft.dotnet-scaffold: fixed version unverified, check the MSRC advisory
• Microsoft.dotnet-scaffold-aspnet: before 9.0.13
• Microsoft.DotNet.Web.ProjectTemplates.10.0: before 10.0.15
• Microsoft.DotNet.Web.ProjectTemplates.9.0: before 9.0.23
• Microsoft.DotNet.Web.ProjectTemplates.8.0: before 8.0.34
• Microsoft.VisualStudio.Web.CodeGeneration.Design and Microsoft.VisualStudio.Web.CodeGenerators.Mvc: before 10.0.3 according to the CVE record, unverified
• Microsoft's .NET blog lists the fix in the November 10, 2026 servicing release. Installing the runtime alone does not fix the issue.

Workaround

Unknown. No workaround is documented. Update the affected packages and then regenerate, rebuild and redeploy the affected applications.

Exploitation

• No exploitation known at the time of analysis.
• No public proof of concept or CISA KEV listing found.
• The CVE record gives exploit maturity as Unproven.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Inventory .NET SDKs and scaffolding or template packages on developer machines and in CI pipelines.
• Update these packages to the fixed versions from the MSRC advisory.
• Regenerate, rebuild and redeploy applications that were scaffolded with Identity features.
• Review password-reset and account-recovery logic in those applications.
• Treat this as a priority for internet-facing applications. Otherwise handle it in the standard patch cycle.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-118741 msrc.microsoft.com
• CVE Record CVE-2026-118741 www.cve.org
• .NET and .NET Framework November 2026 servicing updates devblogs.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:43.