Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-114148

ASP.NET Core Elevation of Privilege Vulnerability

CVSS 7.8 HighEPSS 0.0036 · 29th percentile

Published by the CVE Program (CNA: microsoft) at 29 Oct 2026, 15:21 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Microsoft .NET 10.0 installed on Linux
  • affected 10.0.0 to before 10.0.403 custom
Microsoft .NET 10.0 installed on Mac OS
  • affected 10.0.0 to before 10.0.403 custom
Microsoft .NET 10.0 installed on Windows
  • affected 10.0.0 to before 10.0.403 custom
Microsoft .NET 11.0 installed on Linux
  • affected 11.0.0-preview.1 to before 11.0.100-rc.3 custom
Microsoft .NET 11.0 installed on Mac OS
  • affected 11.0.0-preview.1 to before 11.0.100-rc.3 custom
Microsoft .NET 11.0 installed on Windows
  • affected 11.0.0-preview.1 to before 11.0.100-rc.3 custom
Microsoft .NET 8.0 installed on Linux
  • affected 8.0.0 to before 8.0.427 custom
Microsoft .NET 8.0 installed on Mac OS
  • affected 8.0.0 to before 8.0.427 custom
Microsoft .NET 8.0 installed on Windows
  • affected 8.0.0 to before 8.0.427 custom
Microsoft .NET 9.0 installed on Linux
  • affected 9.0.0 to before 9.0.320 custom
Microsoft .NET 9.0 installed on Mac OS
  • affected 9.0.0 to before 9.0.320 custom
Microsoft .NET 9.0 installed on Windows
  • affected 9.0.0 to before 9.0.320 custom
Microsoft .NET source-build Linux tarballs (all archive types)
  • affected 8.0.100 to before 10.0.403-servicing.26523.112 custom
Microsoft ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published)
  • affected 8.0.0 to before 9.0.22 custom
Identifiers
CVE-2026-114148
CNA
microsoft
Weakness (CWE)
CWE-276
Tags
Published
29 Oct 2026
Updated
31 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.8 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C CNA (microsoft)
  • CISA KEV Not listed.
  • EPSS 0.0036, the 29th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 29 Oct 2026, 15:21 UTC Confirmed by the CVE List
  2. 31 Oct 2026, 16:31 UTC First seen by agentprime

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.