Oct 2026: ASP.NET Core Elevation of Privilege Vulnerability
CVE-2026-114148 Published on October 29, 2026

ASP.NET Core Elevation of Privilege Vulnerability
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Vendor Advisory NVD

Vulnerability Analysis

Exploitation:

NONE

Automatable:

Technical Impact:

TOTAL

Weakness Type

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

Products Associated with CVE-2026-114148

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-114148 are published in these products:

Canonical Ubuntu Linux

Microsoft Net 8 0 Installed On Windows

Microsoft Net 8 0 Installed On Linux

Microsoft Net 8 0 Installed On Mac Os

Microsoft Net 9 0 Installed On Windows

Microsoft Net 9 0 Installed On Linux

Microsoft Net 9 0 Installed On Mac Os

Microsoft Net 10 0 Installed On Windows

Microsoft Net 10 0 Installed On Linux

Microsoft Net 10 0 Installed On Mac Os

Microsoft Net 11 0 Installed On Windows

Microsoft Net 11 0 Installed On Linux

Microsoft Net 11 0 Installed On Mac Os

Asp Net Core Runtime Targeting Pack Linux Tarballs Microsoft Published

Microsoft Net Source Build Linux Tarballs All Archive Types

Affected Versions

Microsoft .NET 10.0 installed on Linux:

Version 10.0.0 and below 10.0.403 is affected.

Microsoft .NET 10.0 installed on Mac OS:

Version 10.0.0 and below 10.0.403 is affected.

Microsoft .NET 10.0 installed on Windows:

Version 10.0.0 and below 10.0.403 is affected.

Microsoft .NET 11.0 installed on Linux:

Version 11.0.0-preview.1 and below 11.0.100-rc.3 is affected.

Microsoft .NET 11.0 installed on Mac OS:

Version 11.0.0-preview.1 and below 11.0.100-rc.3 is affected.

Microsoft .NET 11.0 installed on Windows:

Version 11.0.0-preview.1 and below 11.0.100-rc.3 is affected.

Microsoft .NET 8.0 installed on Linux:

Version 8.0.0 and below 8.0.427 is affected.

Microsoft .NET 8.0 installed on Mac OS:

Version 8.0.0 and below 8.0.427 is affected.

Microsoft .NET 8.0 installed on Windows:

Version 8.0.0 and below 8.0.427 is affected.

Microsoft .NET 9.0 installed on Linux:

Version 9.0.0 and below 9.0.320 is affected.

Microsoft .NET 9.0 installed on Mac OS:

Version 9.0.0 and below 9.0.320 is affected.

Microsoft .NET 9.0 installed on Windows:

Version 9.0.0 and below 9.0.320 is affected.

Microsoft .NET source-build Linux tarballs (all archive types):

Version 8.0.100 and below 10.0.403-servicing.26523.112 is affected.

ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published):