CVE-2026-114148
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges…
- Risk score
- 62/100
- CVSS
- 7.8 v3.1
- Published
- 25 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Incorrect default permissions in ASP.NET Core allow an authorized attacker to elevate privileges locally, potentially leading to high impact.
- Affected
- {'vendor': 'Microsoft', 'product': 'ASP.NET Core'}
- Fix
- Check the linked advisory for the concrete fix, as no specific version or action is provided.
- Exploitation
- No known exploitation
Story map
At a glance
Microsoft.AspNetCore.Components.WebAssembly.Server: Red, act today. A vulnerability in ASP.NET Core allows an attacker to execute code over a network, potentially leading to remote code execution. An attacker could exploit this vulnerability to execute code without requiring authentication.
The flaws
- CVE-2026-114148: Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges… (CVSS 7.8)
- CVE-2026-102870: Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability (CVSS 8.8 · EPSS 1%)
The fix
Fix: Upgrade to version 10.0.13 or 11.0.0-rc.2.26478.115
Who is exposed: {'products': ['ASP.NET Core'], 'packages': [{'ecosystem': 'nuget', 'name': 'Microsoft.AspNetCore.Components.WebAssembly.Server', 'vulnerable': '>= 10.0.0, <= 10.0.12'}, {'ecosystem': 'nuget', 'name': 'Microsoft.AspNetCore.Components.WebAssembly.Server', 'vulnerable': '>= 11.0.0-preview.1, <= 11.0.0-rc.1'}], 'versions'…
Where it stands
- No known exploitation
- 1 outlet covering it
How it unfolded
- 25 Oct, Microsoft Security Response Center (official): CVE-2026-114148 ASP.NET Core Elevation of Privilege Vulnerability
- 25 Oct, Microsoft Security Response Center (official): CVE-2026-102870 ASP.NET Core Remote Code Execution Vulnerability
- 26 Oct, Infosecurity Magazine (press): Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw
- 29 Oct, Ubuntu security notices (official): USN-8958-1: .NET vulnerabilities
Connects to
- Same weakness: CWE-276 (CWE-276). 11 other warnings in 30 days
- Reported alongside: Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability. CVE-2026-70197 · in 1 of the same article
- Reported alongside: Google Brotli Unchecked Return Value Vulnerability. CVE-2026-111497 · in 1 of the same article
In the news
TL;DR
Microsoft patches critical .NET buffer overflow flaw, including CVE-2026-114148, in emergency update.
- Microsoft releases out-of-bound security updates for .NET versions 8, 9, 10, and 11 RC3.
- CVE-2026-114148 allows authorized attacker to elevate privileges locally.
- Updates contain patches for two newly disclosed vulnerabilities and two flaws not fully addressed in October Patch Tuesday.
- Users urged to apply updates as soon as possible to reduce risk of compromise.
AI summary of 1 article.
Why it is Amber
- CVSS 7.8 high
- On your watchlist: asp.net core
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Last activity 29 Oct 2026. Patch Forecast updates every hour.