Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges could an attacker gain by successfully exploiting this vulnerability?
An attacker could execute code with the permissions of another user on the affected system. This could give the attacker access to data and resources available to that user.
Security updates
13.6.5 — https://github.com/microsoft/aspire/releases/tag/v13.6.5
Vulnerabilities 1
-
High 7.3
Aspire Elevation of Privilege Vulnerability
Creation of temporary file in directory with insecure permissions in .NET Aspire allows an authorized attacker to elevate privileges locally.
Revision history
-
#2
Updated the products listed in the Security Updates table. This is an informational change only.
-
#1
Information published.
References
-
CVE-2026-120778 Aspire Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-120778
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss