Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker with access to a local Windows account could bypass the isolation intended to restrict an affected ASP.NET Core service to its own account. Successful exploitation could allow the attacker to access data or perform operations exposed by that service without the intended authorization.
Security updates
8.0.34 — https://support.microsoft.com/help/5135243
9.0.23 — https://support.microsoft.com/help/5135242
10.0.15 — https://support.microsoft.com/help/5135241
11.0.0 — https://github.com/dotnet/core/blob/main/release-notes/11.0/11.0.0/11.0.0.md
17.14.45 — https://learn.microsoft.com/en-us/visualstudio/releases/2022/release-notes
18.11.4 — https://learn.microsoft.com/en-us/visualstudio/releases/2026/release-notes
Vulnerabilities 1
-
High 7.5
ASP.NET Core Security Feature Bypass Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Revision history
-
#2
Changes made to the security updates links and information. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-114157 ASP.NET Core Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114157
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss