Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The authentication feature could be bypassed as this vulnerability allows impersonation.
How could an attacker exploit this vulnerability?
An unauthenticated attacker with network access to an affected dashboard could send specially crafted requests to bypass authentication. Successful exploitation could allow the attacker to access sensitive information and modify or delete telemetry data. User interaction is not required.
Security updates
13.6.5 — https://github.com/microsoft/aspire/releases/tag/v13.6.5
Vulnerabilities 1
-
Critical 9.1
Aspire Security Feature Bypass Vulnerability
Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.
Revision history
-
#2
Corrected Download links in the Security Updates table. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-118740 Aspire Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118740
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss