---
id: "CVE-2026-114155"
page: "https://infrastack.ai/live/CVE-2026-114155"
kind: "vulnerability"
aliases: ["CVE-2026-114155", "GHSA-q7j6-px74-p2vw"]
title: "Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": ".NET", "fixed": [], "affected": "", "ecosystem": "runtime"}, {"name": ".NET 10.0 (Linux, macOS)", "fixed": ["10.0.404"], "affected": ">= 10.0.0, < 10.0.404", "ecosystem": "runtime"}, {"name": ".NET 11.0 (Linux, macOS)", "fixed": ["11.0.100"], "affected": ">= 11.0.0-preview.1, < 11.0.100", "ecosystem": "runtime"}, {"name": "Microsoft.DotNet.HotReload.Watch.Aspire", "fixed": ["11.0.100"], "affected": ">= 10.0.300, < 11.0.100", "ecosystem": "nuget"}, {"name": "Microsoft.DotNet.HotReload.Watch.Aspire", "fixed": ["10.0.404"], "affected": ">= 10.0.300, <= 10.0.303", "ecosystem": "nuget"}, {"name": "Microsoft.DotNet.HotReload.Watch.Aspire", "fixed": ["10.0.404"], "affected": ">= 10.0.400, <= 10.0.403", "ecosystem": "nuget"}, {"name": "Microsoft.DotNet.HotReload.Watch.Aspire", "fixed": ["11.0.100"], "affected": ">= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148", "ecosystem": "nuget"}]
ecosystems: ["nuget", "runtime"]
tags: ["cwe-367", "dotnet", "linux", "local-privilege-escalation", "macos", "runtime", "windows"]
not_affected_if: [".net-8", ".net-9", "windows-only-hosts"]
published_at: "2026-11-10T19:19:08+00:00"
first_seen_at: "2026-11-10T19:24:43+00:00"
updated_at: "2026-11-11T00:14:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114155", "first_seen_at": "2026-11-10T19:24:43+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-114155", "first_seen_at": "2026-11-10T23:43:10+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-114155", "https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/"]}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-q7j6-px74-p2vw", "first_seen_at": "2026-11-11T00:14:39+00:00"}]
exploit_sources: []
---

# Microsoft Security Advisory CVE-2026-114155 - .NET Elevation of Privilege Vulnerability

Link for people: https://infrastack.ai/live/CVE-2026-114155 (this .md is for agents)

A time-of-check time-of-use race condition (CWE-367) in .NET lets a local, already-authorized attacker elevate privileges. Microsoft's affected list covers .NET 10 on Linux and macOS before 10.0.404, .NET 11 on Linux and macOS (preview.1 up to before 11.0.100), and the Microsoft.DotNet.HotReload.Watch.Aspire package. Not known to be exploited. CVSS 7.5, local, high complexity, user interaction needed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- runtime:.NET affected range not listed fixed no fixed version listed
- runtime:.NET 10.0 (Linux, macOS) affected >= 10.0.0, < 10.0.404 fixed 10.0.404
- runtime:.NET 11.0 (Linux, macOS) affected >= 11.0.0-preview.1, < 11.0.100 fixed 11.0.100
- nuget:Microsoft.DotNet.HotReload.Watch.Aspire affected >= 10.0.300, < 11.0.100 fixed 11.0.100
- nuget:Microsoft.DotNet.HotReload.Watch.Aspire affected >= 10.0.300, <= 10.0.303 fixed 10.0.404
- nuget:Microsoft.DotNet.HotReload.Watch.Aspire affected >= 10.0.400, <= 10.0.403 fixed 10.0.404
- nuget:Microsoft.DotNet.HotReload.Watch.Aspire affected >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 fixed 11.0.100

## How to check

Run 'dotnet --info' and read the SDK and runtime versions. Exposed if you are on Linux or macOS with .NET 10 SDK below 10.0.404 or .NET 11 below 11.0.100. Also check whether the Microsoft.DotNet.HotReload.Watch.Aspire package is in your dotnet-watch or Aspire tooling (Microsoft lists 10.0.300 up to before 11.0.100).

## Fix

Update to .NET 10.0.404 or later, or .NET 11.0.100 or later, from the November 2026 servicing release. Per NVD, which cites the Microsoft CNA entry. Confirm exact numbers on the MSRC page.

## Timeline

- 2026-11-10T19:24:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114155
- 2026-11-10T23:43:10+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-114155 — Microsoft CNA data via NVD lists .NET 10 (Linux, macOS) <10.0.404 and .NET 11 <11.0.100 (Linux, macOS); Nov 10 2026 .NET servicing post lists CVE for .NET 10 and 11 only. MSRC page is JS-only and was not read; Windows is not in the affected list. The fix versions are the NVD figures, not checked against the MSRC page. The post's release table gives runtime 10.0.15 and 11.0.0, which do not map to 10.0.404 without the advisory.
- 2026-11-11T00:14:39+00:00 ghsa https://github.com/advisories/GHSA-q7j6-px74-p2vw

## Documents

- [advisory] NVD CVE-2026-114155 (Microsoft CNA affected list) https://nvd.nist.gov/vuln/detail/cve-2026-114155
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/dotnet/sdk/security-advisories/GHSA-q7j6-px74-p2vw
- [advisory] Maintainer's advisory: github.com https://github.com/dotnet/sdk/security/advisories/GHSA-q7j6-px74-p2vw
- [fix] .NET and .NET Framework November 2026 servicing updates https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/

## From the sources

## Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in the .NET SDK's dotnet-watch component. This advisory provides guidance on updating affected SDK installations.

A local attacker who can replace or modify a temporary solution file used by dotnet-watch can alter a subsequent build. The fix stores generated solution files in a private temporary directory and keeps each file open with read-only sharing while the build uses it.

## Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/502

## CVSS Details

- **Version:** 3.1
- **Severity:** High
- **Score:** 7.5 (base score)
- **Vector:** `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C`
- **Weakness:** CWE-367
- **MSRC severity:** Important
- **Impact:** Elevation of Privilege

## Affected Platforms

- **Platforms:** Linux, macOS.
- **Architectures:** Linux: Arm, Arm64, x64; macOS: Arm64, x64

Windows is outside this advisory's affected scope when its temporary directory is private to the current user, as assumed by the implementation. Shared or insecurely configured Windows temporary directories are not covered by that assumption.

## <a name="affected-packages"></a>Affected Packages

The .NET SDK includes dotnet-watch and the Microsoft.DotNet.HotReload.Watch assembly.

Each SDK feature band is a separate servicing line. Update an affected 10.0.3xx installation to the fixed 10.0.4xx SDK listed below.

### .NET SDK 10.0.3xx

Package | Affected version | Patched version
--- | --- | ---
[.NET SDK (dotnet-watch) 10.0.3xx](https://dotnet.microsoft.com/download/dotnet/10.0) | >= 10.0.300, <= 10.0.303 | 10.0.404

### .NET SDK 10.0.4xx

Package | Affected version | Patched version
--- | --- | ---
[.NET SDK (dotnet-watch) 10.0.4xx](https://dotnet.microsoft.com/download/dotnet/10.0) | >= 10.0.400, <= 10.0.403 | 10.0.404

### .NET SDK 11.0.1xx

Package | Affected version | Patched version
--- | --- | ---
[.NET SDK (dotnet-watch) 11.0.1xx](https://dotnet.microsoft.com/download/dotnet/11.0) | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100

### Separately restored Aspire watch tool

Package | Affected version | Patched version
--- | --- | ---
[Microsoft.DotNet.HotReload.Watch.Aspire](https://www.nuget.org/packages/Microsoft.DotNet.HotReload.Watch.Aspire) | >= 10.0.300, <= 10.0.303 | 10.0.404
[Microsoft.DotNet.HotReload.Watch.Aspire](https://www.nuget.org/packages/Microsoft.DotNet.HotReload.Watch.Aspire) | >= 10.0.400, <= 10.0.403 | 10.0.404
[Microsoft.DotNet.HotReload.Watch.Aspire](https://www.nuget.org/packages/Microsoft.DotNet.HotReload.Watch.Aspire) | >= 11.0.100-preview.3.26207.106, <= 11.0.100-rc.3.26522.148 | 11.0.100

This tool has its own copy of the watch implementation. Updating the SDK does not necessarily replace a separately restored tool.

## Advisory FAQ

### <a name="how-affected"></a>How do I know if I am affected?

Run `dotnet --version` from the directory where you run dotnet-watch to identify the selected SDK. Use `dotnet --info` and `dotnet --list-sdks` to check its installation path, OS, architecture, and other installed SDKs. Check the nearest applicable `global.json`, including its `version` and `rollForward` settings: installing a newer SDK does not necessarily change the SDK selected for a pinned project. See [.NET SDK selection](https://learn.microsoft.com/dotnet/core/versions/selection).

Review use of dotnet-watch against the affected intervals above. Membership in a listed feature band alone does not establish that a specific SDK version is vulnerable. For Aspire or other tooling that separately restores Microsoft.DotNet.HotReload.Watch.Aspire, check the actual restored package version separately from the selected SDK.

### <a name="how-fix"></a>How do I fix the issue?

The fixed SDK versions are 10.0.404 and 11.0.100, as applicable. Update each affected SDK installation and restart dotnet-watch. For SDKs installed through Visual Studio, update Visual Studio to a release that includes a fixed SDK. Updating only an application runtime does not replace SDK-bundled tools.

Ensure that `global.json` and its SDK roll-forward policy select a fixed SDK, then rerun `dotnet --version` in the working directory to verify the selection. The SDK-bundled watch tool is installed beneath that selected SDK's `DotnetTools/dotnet-watch` directory.

If Microsoft.DotNet.HotReload.Watch.Aspire is restored separately, update its package reference or the consuming tool's version configuration to 10.0.404 or 11.0.100, as applicable, restore the tool, and restart the consuming process. An SDK update alone does not update that restored copy.

## Other Information

### Reporting Security Issues

If you have found a potential security issue in a supported version of .NET, please report it to the Microsoft Security Response Center (MSRC) via the [MSRC Researcher Portal](https://msrc.microsoft.com/report/vulnerability/new). Further information can be found in the MSRC [Report an Issue FAQ](https://www.microsoft.com/msrc/faqs-report-an-issue).

Security reports made through MSRC may qualify for the Microsoft .NET Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at https://aka.ms/corebounty.

### Support

You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/runtime. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.

### Disclaimer

The information provided in this advisory is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

### External Links

[CVE-2026-114155](https://www.cve.org/CVERecord?id=CVE-2026-114155)

### Acknowledgements

- [Ky0toFu](https://x.com/ky0tofu)

### Revisions

V1.0 (November 10, 2026): Advisory published.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_