Nov 2026: ASP.NET Core Security Feature Bypass Vulnerability
CVE-2026-114156 Published on November 10, 2026
ASP.NET Core Security Feature Bypass Vulnerability
Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.
Vulnerability Analysis
Weakness Type
Improper Resolution of Path Equivalence
The system or application is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. Path equivalence is usually employed in order to circumvent access controls expressed using an incomplete set of file name or file path representations. This is different from path traversal, wherein the manipulations are performed to generate a name for a different object.
Products Associated with CVE-2026-114156
Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.
