CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Affected

Microsoft · .NET 10.0 installed on Linux · .NET 10.0 installed on Mac OS · .NET 10.0 installed on Windows · .NET 11.0 installed on Linux · .NET 11.0 installed on Mac OS · .NET 11.0 installed on Windows

CVSS v3.1 MICROSOFT

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2026-10-29

Updated

2026-10-30

Proof-of-concept exploits (1)

• Ghost-Bx1/DotNet-Tarball-CVE-2026-114148Repo stars 0★ · pushed 2026-10-27 · find archive
  3 files

  exploit.pyexploit.pypoc.py

CVE references

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114148VENDOR

References

• CVE Record
• NVD entry

Related

• CVE-2024-4577
• CVE-2024-50379
• CVE-2025-0651
• CVE-2025-24813
• CVE-2026-106173
• CVE-2026-107656