{"id":"CVE-2026-114148","state":"PUBLISHED","title":"ASP.NET Core Elevation of Privilege Vulnerability","description":"Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.","publishedAt":"2026-10-29T15:21:47.615Z","updatedAt":"2026-10-30T19:15:02.950Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","source":"microsoft"},"assigner":"microsoft","products":["Microsoft .NET 10.0 installed on Linux","Microsoft .NET 10.0 installed on Mac OS","Microsoft .NET 10.0 installed on Windows","Microsoft .NET 11.0 installed on Linux","Microsoft .NET 11.0 installed on Mac OS","Microsoft .NET 11.0 installed on Windows","Microsoft .NET 8.0 installed on Linux","Microsoft .NET 8.0 installed on Mac OS","Microsoft .NET 8.0 installed on Windows","Microsoft .NET 9.0 installed on Linux","Microsoft .NET 9.0 installed on Mac OS","Microsoft .NET 9.0 installed on Windows","Microsoft .NET source-build Linux tarballs (all archive types)","Microsoft ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)"],"affected":[{"vendor":"Microsoft","product":".NET 10.0 installed on Linux","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.403","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 10.0 installed on Mac OS","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.403","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 10.0 installed on Windows","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.403","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Linux","versions":[{"version":"11.0.0-preview.1","status":"affected","lessThan":"11.0.100-rc.3","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Mac OS","versions":[{"version":"11.0.0-preview.1","status":"affected","lessThan":"11.0.100-rc.3","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Windows","versions":[{"version":"11.0.0-preview.1","status":"affected","lessThan":"11.0.100-rc.3","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Linux","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.427","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Mac OS","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.427","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Windows","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.427","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Linux","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.320","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Mac OS","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.320","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Windows","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.320","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET source-build Linux tarballs (all archive types)","versions":[{"version":"8.0.100","status":"affected","lessThan":"10.0.403-servicing.26523.112","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)","versions":[{"version":"8.0.0","status":"affected","lessThan":"9.0.22","versionType":"custom"}]}],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148"],"weaknesses":["CWE-276"],"ingestedAt":"2026-10-30T19:40:06.317Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/114xxx/CVE-2026-114148.json","commit":"91beacf46587178cb335e3399e6db92524d41de0","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-114148","state":"PUBLISHED","datePublished":"2026-10-29T15:21:47.615Z","dateUpdated":"2026-10-30T19:15:02.950Z","assignerShortName":"microsoft","assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateReserved":"2026-10-20T21:56:39.316Z"},"containers":{"cna":{"title":"ASP.NET Core Elevation of Privilege Vulnerability","descriptions":[{"lang":"en-US","value":"Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally."}],"affected":[{"vendor":"Microsoft","product":".NET 10.0 installed on Linux","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.403","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 10.0 installed on Mac OS","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.403","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 10.0 installed on Windows","versions":[{"version":"10.0.0","status":"affected","lessThan":"10.0.403","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Linux","versions":[{"version":"11.0.0-preview.1","status":"affected","lessThan":"11.0.100-rc.3","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Mac OS","versions":[{"version":"11.0.0-preview.1","status":"affected","lessThan":"11.0.100-rc.3","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 11.0 installed on Windows","versions":[{"version":"11.0.0-preview.1","status":"affected","lessThan":"11.0.100-rc.3","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Linux","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.427","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Mac OS","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.427","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 8.0 installed on Windows","versions":[{"version":"8.0.0","status":"affected","lessThan":"8.0.427","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Linux","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.320","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Mac OS","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.320","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET 9.0 installed on Windows","versions":[{"version":"9.0.0","status":"affected","lessThan":"9.0.320","versionType":"custom"}]},{"vendor":"Microsoft","product":".NET source-build Linux tarballs (all archive types)","versions":[{"version":"8.0.100","status":"affected","lessThan":"10.0.403-servicing.26523.112","versionType":"custom"}]},{"vendor":"Microsoft","product":"ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)","versions":[{"version":"8.0.0","status":"affected","lessThan":"9.0.22","versionType":"custom"}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148","name":"ASP.NET Core Elevation of Privilege Vulnerability","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en-US","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","baseSeverity":"HIGH","baseScore":7.8,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-276","description":"CWE-276: Incorrect Default Permissions","lang":"en-US","type":"CWE"}]}],"providerMetadata":{"shortName":"microsoft","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","dateUpdated":"2026-10-30T19:15:02.950Z"},"datePublic":"2026-10-25T14:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.427"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.427"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.427"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.320"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.320"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.0.320"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.403"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.403"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.403"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0-preview.1","versionEndExcluding":"11.0.100-rc.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0-preview.1","versionEndExcluding":"11.0.100-rc.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0-preview.1","versionEndExcluding":"11.0.100-rc.3"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"9.0.22"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_source-build_linux_tarballs_all_archive_types:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.100","versionEndExcluding":"10.0.403-servicing.26523.112"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-114148","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-30T13:38:21.442156Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-30T13:46:52.704Z"}}]}}}