CVE-2026-114157 · Runtime
NO FIX YET
ASP.NET Core has a race condition in how it handles a shared resource without proper synchronization. An authorized attacker with local access can use it to elevate their privileges.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running ASP.NET Core applications on servers where local users hold accounts. The sources do not say which configurations or versions are affected, and do not describe the vulnerable code path.
Who cares aspnet-core, dotnet, windows
Unknown from the sources. In the analyst’s queue.
No fix yet, per the sources.
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.