{"id":"CVE-2026-114157","kind":"vulnerability","aliases":["CVE-2026-114157"],"related":[],"title":"ASP.NET Core: race condition lets a local user gain higher privileges","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.","summary":"ASP.NET Core has a race condition in how it handles a shared resource without proper synchronization. An authorized attacker with local access can use it to elevate their privileges.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft.AspNetCore.App","fixed":["8.0.34","9.0.23","10.0.15","11.0.0"],"affected":">= 8.0.0, < 8.0.34; >= 9.0.0, < 9.0.23; >= 10.0.0, < 10.0.15; >= 11.0.0-preview.1, < 11.0.0","ecosystem":"dotnet"},{"name":"Visual Studio 2022 17.14","fixed":["17.14.45"],"affected":">= 17.14.0, < 17.14.45","ecosystem":"vendor"}],"ecosystems":[],"tags":["aspnet-core","dotnet","local","runtime","windows"],"not_affected_if":["linux","patched-runtime","single-user-host"],"how_to_check":"Run 'dotnet --list-runtimes' and look at Microsoft.AspNetCore.App on Windows hosts: affected if below 8.0.34, 9.0.23, 10.0.15 or 11.0.0 (GA). Also check any self-contained or bundled deployments, and Visual Studio 2022 17.14 below 17.14.45 (NVD lists VS 2026 too; the fixed build for it is not confirmed here).","fix":"Install the November 10, 2026 servicing releases: .NET 8.0.34, .NET 9.0.23, .NET 10.0.15 or .NET 11.0.0 (Windows runtimes); Visual Studio 2022 17.14.45 or later. Rebuild and redeploy self-contained apps.","status":"open","published_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:44:56+00:00","updated_at":"2026-11-10T23:43:08+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-10T19:44:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"ASP.NET Core: race condition lets a local user gain higher privileges","impact":"high","summary":"ASP.NET Core has a race condition in how it handles a shared resource without proper synchronization. An authorized attacker with local access can use it to elevate their privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["aspnet-core","dotnet","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains elevated privileges on the host","analyst_note":"Find the affected ASP.NET Core versions, the fixed versions and the vulnerable component in the NVD entry and Microsoft's advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running ASP.NET Core applications on servers where local users hold accounts. The sources do not say which configurations or versions are affected, and do not describe the vulnerable code path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4505,"output_tokens":400,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected ASP.NET Core versions, the fixed versions and the vulnerable component in the NVD entry and Microsoft's advisory.","search":"'-114157':14A,17A '-2026':13A,16A '17.14':22A '2022':21A 'access':51B 'allow':72C 'asp.net':1A,30B,70C 'aspnet':24B 'aspnet-cor':23B 'attack':48B,75C 'author':47B,74C 'concurr':59C 'condit':4A,35B,68C 'core':2A,25B,31B,71C 'cve':12A,15A 'dotnet':26B 'elev':56B,77C 'execut':60C 'gain':9A 'handl':39B 'higher':10A 'improp':65C 'let':5A 'local':7A,27B,50B,79C 'microsoft.aspnetcore.app':18A 'privileg':11A,58B,78C 'proper':44B 'race':3A,34B,67C 'resourc':42B,63C 'runtim':28B 'share':41B,62C 'studio':20A 'synchron':45B,66C 'use':53B,61C 'user':8A 'visual':19A 'window':29B 'without':43B","nicknames":[],"mitigations":[],"who_affected":"ASP.NET Core on Windows with .NET 8 (before 8.0.34), 9 (before 9.0.23), 10 (before 10.0.15) or 11 preview builds (before 11.0.0). It needs a local, authenticated account and a race (high attack complexity), so it matters on shared Windows servers, build hosts and terminal servers. Single-user machines and Linux hosts are not listed by NVD as affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:43:08Z","by":"analyst","doc":"https://nvd.nist.gov/vuln/detail/CVE-2026-114157","run_id":3223}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["microsoftaspnetcoreapp","studio20221714","visualstudio20221714"],"ptokens":["14","17","2022","app","aspnetcore","microsoft","studio","visual"],"labels":["aspnetcore","dotnet","high","local","runtime","windows"],"campaign_type":null,"search_a":"'-114157':14A,17A '-2026':13A,16A '17.14':22A '2022':21A 'asp.net':1A 'condit':4A 'core':2A 'cve':12A,15A 'gain':9A 'higher':10A 'let':5A 'local':7A 'microsoft.aspnetcore.app':18A 'privileg':11A 'race':3A 'studio':20A 'user':8A 'visual':19A","search_b":"'access':51B 'asp.net':30B 'aspnet':24B 'aspnet-cor':23B 'attack':48B 'author':47B 'condit':35B 'core':25B,31B 'dotnet':26B 'elev':56B 'handl':39B 'local':27B,50B 'privileg':58B 'proper':44B 'race':34B 'resourc':42B 'runtim':28B 'share':41B 'synchron':45B 'use':53B 'window':29B 'without':43B","search_c":"'allow':72C 'asp.net':70C 'attack':75C 'author':74C 'concurr':59C 'condit':68C 'core':71C 'elev':77C 'execut':60C 'improp':65C 'local':79C 'privileg':78C 'race':67C 'resourc':63C 'share':62C 'synchron':66C 'use':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114157","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114157","severity":null,"published_at":"2026-11-10T19:19:09+00:00","modified_at":"2026-11-10T19:19:09+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114157:3223","url":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/","severity":null,"published_at":"2026-11-10T23:43:08+00:00","modified_at":"2026-11-10T23:43:08+00:00","first_seen_at":"2026-11-10T23:43:08+00:00","fetched_at":"2026-11-10T23:43:08+00:00","note":"NVD (Microsoft CNA) lists affected/fixed versions; Microsoft's Nov 2026 servicing blog confirms fixed releases. Microsoft blog labels it 'Security Feature Bypass' while CVE text says local elevation of privilege - mismatch. MSRC page not readable; no exploitation or PoC found. Not checked: X/social.","cites":["https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/","https://nvd.nist.gov/vuln/detail/CVE-2026-114157"]}],"documents":[{"id":117591,"url":"https://devblogs.microsoft.com/dotnet/dotnet-and-dotnet-framework-november-2026-servicing-updates/","title":".NET and .NET Framework November 2026 servicing updates","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120432,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114157","title":"NVD CVE-2026-114157 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}