Skip to content
OpenAdvisories
High · 7.5 CVE-2026-114157 EUVD-2026-121980GHSA-7phj-vgxq-r67hGHSA-95x6-7hq8-2c37

ASP.NET Core Security Feature Bypass Vulnerability

Published Nov 10, 2026 · Updated Nov 13, 2026 · Assigned by microsoft

Vendor: Microsoft Product: .NET 10.0 installed on Windows Product: .NET 11.0 installed on Windows Product: .NET 8.0 installed on Windows Product: .NET 9.0 installed on Windows Product: Microsoft Visual Studio 2022 version 17.14 Product: Microsoft Visual Studio 2026 version 18.11 Product: Microsoft Visual Studio 2026 version 18.12 Package: dotnet10-runtime Package: dotnet7 Package: dotnet8-runtime Package: dotnet9-runtime Package: Microsoft.AspNetCore.App.Runtime.win-arm64 Package: Microsoft.AspNetCore.App.Runtime.win-x64 Package: Microsoft.AspNetCore.App.Runtime.win-x86 Platform: Windows Ecosystem: Alpine Ecosystem: NuGet Ecosystem: Ubuntu

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Affected products

VendorProductAffectedFixed
Microsoft .NET 10.0 installed on Windows 10.0.0 – < 10.0.15 10.0.15
Microsoft .NET 11.0 installed on Windows 11.0.0-preview.1 – < 11.0.0 11.0.0
Microsoft .NET 8.0 installed on Windows 8.0.0 – < 8.0.34 8.0.34
Microsoft .NET 9.0 installed on Windows 9.0.0 – < 9.0.23 9.0.23
Microsoft Microsoft Visual Studio 2022 version 17.14 17.14.0 – < 17.14.45 17.14.45
Microsoft Microsoft Visual Studio 2026 version 18.11 18.11.0 – < 18.11.4 18.11.4
Microsoft Microsoft Visual Studio 2026 version 18.12 18.12.0 – < 18.12.0 18.12.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS dotnet7 No fix yet —

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 dotnet10-runtime 10.0.15-r0 —
Alpine v3.24 dotnet8-runtime 8.0.34-r0 —
Alpine v3.24 dotnet9-runtime 9.0.23-r0 —
Alpine v3.23 dotnet8-runtime 8.0.34-r0 —
Alpine v3.23 dotnet9-runtime 9.0.23-r0 —
Alpine v3.22 dotnet8-runtime 8.0.34-r0 —
Alpine v3.22 dotnet9-runtime 9.0.23-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 9.0.0-preview.1.24081.5, < 9.0.23 9.0.23 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 10.0.0-preview.1.25120.3, < 10.0.15 10.0.15 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-arm64 >= 11.0.0-preview.1.26104.118, < 11.0.0 11.0.0 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 9.0.0-preview.1.24081.5, < 9.0.23 9.0.23 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 10.0.0-preview.1.25120.3, < 10.0.15 10.0.15 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x64 >= 11.0.0-preview.1.26104.118, < 11.0.0 11.0.0 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 8.0.0-preview.1.23112.2, < 8.0.34 8.0.34 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 9.0.0-preview.1.24081.5, < 9.0.23 9.0.23 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 10.0.0-preview.1.25120.3, < 10.0.15 10.0.15 GHSA-7phj-vgxq-r67h
NuGet Microsoft.AspNetCore.App.Runtime.win-x86 >= 11.0.0-preview.1.26104.118, < 11.0.0 11.0.0 GHSA-7phj-vgxq-r67h

Advisories 3

References