{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-000071fcbf80","releaseDate":"2026-11-10T08:00:00-08:00","cveNumber":"CVE-2026-118740","cveTitle":"Aspire Security Feature Bypass Vulnerability","releaseNumber":"2026-Nov","vulnType":"Security Vulnerability","latestRevisionDate":"2026-11-11T08:00:00-08:00","description":"<p>Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.</p>\n","cweList":["CWE-862: Missing Authorization"],"cweDetailsListForSearch":["cwe: CWE-862: Missing Authorization","cweUrl: https://cwe.mitre.org/data/definitions/862.html"],"unformattedDescription":"<p>Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.</p>","mitreText":"CVE-2026-118740","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118740","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":2,"latestSoftwareRelease":"Exploitation Less Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Aspire","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000007,"impact":"Security Feature Bypass","langCode":"en-US","baseScore":"9.1","temporalScore":"7.9","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-862: Missing Authorization","https://cwe.mitre.org/data/definitions/862.html"]}],"articles":[{"title":"Authentication Bypass","articleType":"FAQ","description":"<p><strong>What kind of security feature could be bypassed by successfully exploiting this vulnerability?</strong></p>\n<p>The authentication feature could be bypassed as this vulnerability allows impersonation.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>How could an attacker exploit this vulnerability?</strong></p>\n<p>An unauthenticated attacker with network access to an affected dashboard could send specially crafted requests to bypass authentication. Successful exploitation could allow the attacker to access sensitive information and modify or delete telemetry data. User interaction is not required.</p>\n","ordinal":10000},{"title":"Aspire Security Feature Bypass Vulnerability","articleType":"100000000","description":"<p>Missing authorization in Aspire allows an unauthorized attacker to bypass a security feature over a network.</p>\n","ordinal":10000},{"title":".NET Aspire Security Feature Bypass Vulnerability","articleType":"100000000","description":"<p>Missing authorization in .NET Aspire allows an unauthorized attacker to bypass a security feature over a network.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-118740","version":2,"revisionDate":"2026-11-11T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Corrected Download links in the Security Updates table. This is an informational change only.</p>\n","unformattedDescription":"Corrected Download links in the Security Updates table. This is an informational change only.","notificationNeeded":false,"notificationSent":false,"sourceId":"db50af86-f1dd-f111-84e8-6045bd0a04e8"},{"cveNumber":"CVE-2026-118740","version":1,"revisionDate":"2026-11-10T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"760c98bc-c0d3-f111-a059-7ced8d6f0cb4"}]}