CVE-2026-114148

Vendor

Microsoft

Product

.NET 10.0 installed on Linux, .NET 10.0 installed on Mac OS, .NET 10.0 installed on Windows, .NET 11.0 installed on Linux

CVSS v3.1

7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.004 (p29)

Weakness

CWE-276

Exposure class

Developer platform

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 39
   CVE NVD 2d ago

   Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

   Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

   CVSS 7.8 CVE-2026-114148 Microsoft
2. 33
   Advisory MSRC 6d ago

   ASP.NET Core Elevation of Privilege Vulnerability

   Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

   CVE-2026-114148 Microsoft
3. 26
   Ubuntu notice Ubuntu 2d ago

   .NET vulnerabilities

   It was discovered that the .NET Blazor WebAssembly debug proxy did not properly escape certain values. An attacker could possibly use this issue to execute arbitrary code. The fix for this CVE was originally released via…

   CVE-2026-102870CVE-2026-111497CVE-2026-114148 Canonical