Microsoft ASP.NET Core: Privilege escalation through race condition
Summary
ASP.NET Core contains a race condition (CWE-362) in its authorization components, including Blazor AuthorizeRouteView, that allows an authorized attacker to elevate privileges over the network. A stale asynchronous authorization result can be applied after navigation or an authorization state change, bypassing the current [Authorize] decision. Exploitation requires a valid user account, high attack complexity and precise timing. NVD assigns a CVSS 3.1 base score of 7.5 (High).
Affected
- ASP.NET Core 8.0: 8.0.0 to before 8.0.32
- ASP.NET Core 9.0: 9.0.0 to before 9.0.21
- ASP.NET Core 10.0: 10.0.0 to before 10.0.13
- ASP.NET Core 11.0: 11.0.0-preview.1 to before 11.0.0-rc.2
- Visual Studio 2022 version 17.14: 17.14.0 to before 17.14.42
- Visual Studio 2026 version 18.10: 18.10.0 to before 18.10.4
Fixed in
- ASP.NET Core 8.0.32
- ASP.NET Core 9.0.21
- ASP.NET Core 10.0.13
- ASP.NET Core 11.0.0-rc.2
- Visual Studio 2022 17.14.42 and Visual Studio 2026 18.10.4 (first versions outside the affected ranges in the CVE record; not independently confirmed)
Workaround
No workaround found in the sources. Microsoft recommends installing the fixed versions.
- Blazor WebAssembly: update Microsoft.AspNetCore.Components.Authorization and redeploy the app.
Exploitation
- Exploited in the wild: no evidence found. OpenCVE reports the CVE is not in the KEV list; the live CISA KEV catalogue was not checked.
- Public proof of concept: none found; absence not confirmed.
- CISA SSVC: exploitation none, not automatable, technical impact total.
- EPSS score 0.00456 (low).
Our recommendation
- Identify all .NET apps that use Blazor, AuthorizeView or AuthorizeRouteView.
- Update to ASP.NET Core 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2 or later, and to the fixed Visual Studio versions.
- Prioritise internet-facing apps with user logins.
- Plan migration of .NET 6 and 7 apps, as no official fix is available; Ubuntu 22.04 dotnet6 is unpatched.
- Monitor vendor advisories.
Information from Microsoft (Patch Tuesday October 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Response Center advisory msrc.microsoft.com
- GitLab Advisory Database (affected and fixed versions) advisories.gitlab.com
- Red Hat CVE page access.redhat.com
- Red Hat Bugzilla record bugzilla.redhat.com
- Ubuntu security tracker ubuntu.com
- OSV record (Ubuntu) osv.dev
- HeroDevs vulnerability directory (third-party, .NET 6 claim unconfirmed) www.herodevs.com
- OpenCVE CVE page app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 19:02.
Original description (NVD)
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.