{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000e1b69a9d","releaseDate":"2026-11-10T08:00:00-08:00","cveNumber":"CVE-2026-114157","cveTitle":"ASP.NET Core Security Feature Bypass Vulnerability","releaseNumber":"2026-Nov","vulnType":"Security Vulnerability","latestRevisionDate":"2026-11-11T08:00:00-08:00","description":"<p>Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.</p>\n","cweList":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"],"cweDetailsListForSearch":["cwe: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","cweUrl: https://cwe.mitre.org/data/definitions/362.html"],"unformattedDescription":"<p>Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.</p>","mitreText":"CVE-2026-114157","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114157","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"ASP.NET Core","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"7.5","temporalScore":"6.5","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","https://cwe.mitre.org/data/definitions/362.html"]}],"articles":[{"title":"ASP.NET Core Elevation of Privilege Vulnerability","articleType":"100000000","description":"<p>Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?</strong></p>\n<p>Successful exploitation of this vulnerability requires an attacker to win a race condition.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>What kind of security feature could be bypassed by successfully exploiting this vulnerability?</strong></p>\n<p>An attacker with access to a local Windows account could bypass the isolation intended to restrict an affected ASP.NET Core service to its own account. Successful exploitation could allow the attacker to access data or perform operations exposed by that service without the intended authorization.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-114157","version":1,"revisionDate":"2026-11-10T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"627d1154-64ce-f111-a059-00224803da89"},{"cveNumber":"CVE-2026-114157","version":2,"revisionDate":"2026-11-11T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Changes made to the security updates links and information.  This is an informational change only.</p>\n","unformattedDescription":"Changes made to the security updates links and information.  This is an informational change only.","notificationNeeded":false,"notificationSent":false,"sourceId":"4c56a56c-f1dd-f111-84e8-6045bd0a04e8"}]}