Concurrent execution using shared resources with improper synchronization (a race condition) in ASP.NET Core enables an authorized attacker to elevate privileges over a network. This weakness allows a privileged user to gain higher access rights than intended, potentially compromising application integrity and confidentiality.

Microsoft ASP.NET Core versions 8.0, 9.0, 10.0 and 11.0, and Microsoft Visual Studio 2022 version 17.14 and Visual Studio 2026 version 18.10 are affected. Users running any of these products must review version compatibility and updates.

The CVSS score of 7.5 reflects a high severity vulnerability where the attack requires an authorized user and proper network access to the application. The EPSS score is very low (<1%) and the vulnerability is not listed in CISA KEV, suggesting no widespread known exploitation yet. Based on the description, the likely attack vector is the application’s public endpoints accessed by an authorized user, exploiting timing of concurrent requests to trigger privilege escalation within the application runtime.