Description
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Published: 2026-10-29
Score: 7.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
Title ASP.NET Core Elevation of Privilege Vulnerability
First Time appeared Microsoft
Microsoft .net 10.0 Installed On Linux
Microsoft .net 10.0 Installed On Mac Os
Microsoft .net 10.0 Installed On Windows
Microsoft .net 11.0 Installed On Linux
Microsoft .net 11.0 Installed On Mac Os
Microsoft .net 11.0 Installed On Windows
Microsoft .net 8.0 Installed On Linux
Microsoft .net 8.0 Installed On Mac Os
Microsoft .net 8.0 Installed On Windows
Microsoft .net 9.0 Installed On Linux
Microsoft .net 9.0 Installed On Mac Os
Microsoft .net 9.0 Installed On Windows
Microsoft .net Source-build Linux Tarballs All Archive Types
Microsoft asp Net Core Runtime And Targeting-pack Linux Tarballs Microsoft Published
Weaknesses CWE-276
CPEs cpe:2.3:a:microsoft:.net_10.0_installed_on_linux:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_10.0_installed_on_mac_os:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_10.0_installed_on_windows:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_11.0_installed_on_linux:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_11.0_installed_on_mac_os:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_11.0_installed_on_windows:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_8.0_installed_on_linux:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_8.0_installed_on_mac_os:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_8.0_installed_on_windows:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_9.0_installed_on_linux:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_9.0_installed_on_mac_os:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_9.0_installed_on_windows:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:.net_source-build_linux_tarballs_all_archive_types:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:asp_net_core_runtime_and_targeting-pack_linux_tarballs_microsoft_published:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft .net 10.0 Installed On Linux
Microsoft .net 10.0 Installed On Mac Os
Microsoft .net 10.0 Installed On Windows
Microsoft .net 11.0 Installed On Linux
Microsoft .net 11.0 Installed On Mac Os
Microsoft .net 11.0 Installed On Windows
Microsoft .net 8.0 Installed On Linux
Microsoft .net 8.0 Installed On Mac Os
Microsoft .net 8.0 Installed On Windows
Microsoft .net 9.0 Installed On Linux
Microsoft .net 9.0 Installed On Mac Os
Microsoft .net 9.0 Installed On Windows
Microsoft .net Source-build Linux Tarballs All Archive Types
Microsoft asp Net Core Runtime And Targeting-pack Linux Tarballs Microsoft Published
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft .net 10.0 Installed On Linux .net 10.0 Installed On Mac Os .net 10.0 Installed On Windows .net 11.0 Installed On Linux .net 11.0 Installed On Mac Os .net 11.0 Installed On Windows .net 8.0 Installed On Linux .net 8.0 Installed On Mac Os .net 8.0 Installed On Windows .net 9.0 Installed On Linux .net 9.0 Installed On Mac Os .net 9.0 Installed On Windows .net Source-build Linux Tarballs All Archive Types Asp Net Core Runtime And Targeting-pack Linux Tarballs Microsoft Published
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-29T15:21:47.615Z

Reserved: 2026-10-20T21:56:39.316Z

Link: CVE-2026-114148

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-276

    Incorrect Default Permissions