CVE-2026-114148
Awaiting Analysis
Awaiting Analysis - Queue
Incorrect Default Permissions in ASP.NET Core Elevates Privileges
Vulnerability report for CVE-2026-114148, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: Microsoft Corporation
Description
Description
Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Microsoft | .NET 10.0 installed on Linux | 10.0.0 |
| Microsoft | .NET 10.0 installed on Mac OS | 10.0.0 |
| Microsoft | .NET 10.0 installed on Windows | 10.0.0 |
| Microsoft | .NET 11.0 installed on Linux | 11.0.0-preview.1 |
| Microsoft | .NET 11.0 installed on Mac OS | 11.0.0-preview.1 |
| Microsoft | .NET 11.0 installed on Windows | 11.0.0-preview.1 |
| Microsoft | .NET 8.0 installed on Linux | 8.0.0 |
| Microsoft | .NET 8.0 installed on Mac OS | 8.0.0 |
| Microsoft | .NET 8.0 installed on Windows | 8.0.0 |
| Microsoft | .NET 9.0 installed on Linux | 9.0.0 |
| Microsoft | .NET 9.0 installed on Mac OS | 9.0.0 |
| Microsoft | .NET 9.0 installed on Windows | 9.0.0 |
| Microsoft | .NET source-build Linux tarballs (all archive types) | 8.0.100 |
| Microsoft | ASP.NET Core runtime and targeting-pack Linux tarballs (Microsoft-published) | 8.0.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
