{"id":"CVE-2026-114156","kind":"vulnerability","aliases":["CVE-2026-114156"],"related":[],"title":"ASP.NET Core: input validation flaw lets attackers bypass a security feature","description":"Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network.","summary":"Improper input validation in ASP.NET Core lets an unauthenticated attacker bypass a security feature over the network. The sources do not name the exact feature or the affected versions.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aspnet-core","dotnet","runtime","web"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:08+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:57:52+00:00","updated_at":"2026-11-10T19:57:52+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-10T19:57:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ASP.NET Core: input validation flaw lets attackers bypass a security feature","impact":"medium","summary":"Improper input validation in ASP.NET Core lets an unauthenticated attacker bypass a security feature over the network. The sources do not name the exact feature or the affected versions.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","web"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker bypasses a security control over the network","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114156 and Microsoft's advisory for the affected feature, versions and fixed release.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"ASP.NET Core web applications that rely on the affected security feature for protection. The sources do not say which feature or which versions, so the exposure cannot be narrowed further. Teams not running ASP.NET Core can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":4491,"output_tokens":436,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114156':14A,17A '-2026':13A,16A 'affect':51B 'allow':59C 'asp.net':1A,28B,57C 'aspnet':19B 'aspnet-cor':18B 'attack':7A,33B,62C 'bypass':8A,34B,64C 'core':2A,20B,29B,58C 'cve':12A,15A 'dotnet':21B 'exact':47B 'featur':11A,37B,48B,67C 'flaw':5A 'improp':24B,53C 'input':3A,25B,54C 'let':6A,30B 'name':45B 'network':40B,70C 'runtim':22B 'secur':10A,36B,66C 'sourc':42B 'unauthent':32B 'unauthor':61C 'valid':4A,26B,55C 'version':52B 'web':23B","nicknames":[],"mitigations":[],"who_affected":"ASP.NET Core web applications that rely on the affected security feature for protection. The sources do not say which feature or which versions, so the exposure cannot be narrowed further. Teams not running ASP.NET Core can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aspnetcore","dotnet","medium","runtime","web"],"campaign_type":null,"search_a":"'-114156':14A,17A '-2026':13A,16A 'asp.net':1A 'attack':7A 'bypass':8A 'core':2A 'cve':12A,15A 'featur':11A 'flaw':5A 'input':3A 'let':6A 'secur':10A 'valid':4A","search_b":"'affect':51B 'asp.net':28B 'aspnet':19B 'aspnet-cor':18B 'attack':33B 'bypass':34B 'core':20B,29B 'dotnet':21B 'exact':47B 'featur':37B,48B 'improp':24B 'input':25B 'let':30B 'name':45B 'network':40B 'runtim':22B 'secur':36B 'sourc':42B 'unauthent':32B 'valid':26B 'version':52B 'web':23B","search_c":"'allow':59C 'asp.net':57C 'attack':62C 'bypass':64C 'core':58C 'featur':67C 'improp':53C 'input':54C 'network':70C 'secur':66C 'unauthor':61C 'valid':55C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114156","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114156","severity":null,"published_at":"2026-11-10T19:19:08+00:00","modified_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}