Every CVESearch/Get API key

CVE-2026-114157

ASP.NET Core Security Feature Bypass Vulnerability

7.5 HighFix available

CVE-2026-114157 is a high vulnerability (CVSS 7.5) in Microsoft .net 10.0 Installed On Windows, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in Microsoft.AspNetCore.App.Runtime.win-arm64 8.0.34.

Severity
7.5 HighCVSS 3.1, CVE List
Exploit chance
0.25%EPSS, 16th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
8.0.34Microsoft.AspNetCore.App.Runtime.win-arm64 +31 more

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.25%Unchanged since Nov 11, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
8.0.0-preview.1.23112.2 to 8.0.33
8.0.34
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
8.0.0-preview.1.23112.2 to 8.0.33
8.0.34
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
8.0.0-preview.1.23112.2 to 8.0.33
8.0.34
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
9.0.0-preview.1.24081.5 to 9.0.22
9.0.23
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
9.0.0-preview.1.24081.5 to 9.0.22
9.0.23
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
9.0.0-preview.1.24081.5 to 9.0.22
9.0.23
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
10.0.0-preview.1.25120.3 to 10.0.14
10.0.15
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
10.0.0-preview.1.25120.3 to 10.0.14
10.0.15
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
10.0.0-preview.1.25120.3 to 10.0.14
10.0.15
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Show 22 moreShow less
Affected packages
PackageAffectedFixed
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
11.0.0-preview.1.26104.118 to 11.0.0-rc.3.26522.148
11.0.0
dotnet10-runtime
Alpine:v3.24
before 10.0.15-r0
10.0.15-r0
dotnet8-runtime
Alpine:v3.22
before 8.0.34-r0
8.0.34-r0
dotnet8-runtime
Alpine:v3.23
before 8.0.34-r0
8.0.34-r0
dotnet8-runtime
Alpine:v3.24
before 8.0.34-r0
8.0.34-r0
dotnet9-runtime
Alpine:v3.22
before 9.0.23-r0
9.0.23-r0
dotnet9-runtime
Alpine:v3.23
before 9.0.23-r0
9.0.23-r0
dotnet9-runtime
Alpine:v3.24
before 9.0.23-r0
9.0.23-r0
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
8.0.0-preview.1.23112.2 up to 8.0.34, plus listed versions
8.0.08.0.18.0.108.0.118.0.12
Show 28 moreShow less
8.0.138.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8
8.0.34
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
8.0.0-preview.1.23112.2 up to 8.0.34, plus listed versions
8.0.08.0.18.0.108.0.118.0.12
Show 28 moreShow less
8.0.138.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8
8.0.34
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
8.0.0-preview.1.23112.2 up to 8.0.34, plus listed versions
8.0.08.0.18.0.108.0.118.0.12
Show 28 moreShow less
8.0.138.0.148.0.158.0.168.0.178.0.188.0.198.0.28.0.208.0.218.0.228.0.238.0.248.0.258.0.268.0.278.0.288.0.298.0.38.0.308.0.318.0.328.0.338.0.48.0.58.0.68.0.78.0.8
8.0.34
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
9.0.0-preview.1.24081.5 up to 9.0.23, plus listed versions
9.0.09.0.19.0.109.0.119.0.12
Show 18 moreShow less
9.0.139.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.23
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
9.0.0-preview.1.24081.5 up to 9.0.23, plus listed versions
9.0.09.0.19.0.109.0.119.0.12
Show 18 moreShow less
9.0.139.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.23
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
9.0.0-preview.1.24081.5 up to 9.0.23, plus listed versions
9.0.09.0.19.0.109.0.119.0.12
Show 18 moreShow less
9.0.139.0.149.0.159.0.169.0.179.0.189.0.199.0.29.0.209.0.219.0.229.0.39.0.49.0.59.0.69.0.79.0.89.0.9
9.0.23
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
10.0.0-preview.1.25120.3 up to 10.0.15, plus listed versions
10.0.010.0.110.0.1010.0.1110.0.12
Show 10 moreShow less
10.0.1310.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9
10.0.15
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
10.0.0-preview.1.25120.3 up to 10.0.15, plus listed versions
10.0.010.0.110.0.1010.0.1110.0.12
Show 10 moreShow less
10.0.1310.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9
10.0.15
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
10.0.0-preview.1.25120.3 up to 10.0.15, plus listed versions
10.0.010.0.110.0.1010.0.1110.0.12
Show 10 moreShow less
10.0.1310.0.1410.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.9
10.0.15
Microsoft.AspNetCore.App.Runtime.win-arm64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.AspNetCore.App.Runtime.win-x64
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
Microsoft.AspNetCore.App.Runtime.win-x86
NuGet
11.0.0-preview.1.26104.118 up to 11.0.0
11.0.0
dotnet7
Ubuntu:22.04:LTS
All versions, plus listed versions
7.0.105-0ubuntu1~22.04.17.0.107-0ubuntu1~22.04.17.0.108-0ubuntu1~22.04.17.0.109-0ubuntu1~22.04.17.0.110-0ubuntu1~22.04.1
Show 9 moreShow less
7.0.111-0ubuntu1~22.04.17.0.112-0ubuntu1~22.04.17.0.113-0ubuntu1~22.04.17.0.114-0ubuntu1~22.04.17.0.115-0ubuntu1~22.04.17.0.116-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.17.0.117-0ubuntu1~22.04.27.0.119-0ubuntu1~22.04.1
None known

What each source reports

CVE List Score used7.5

ASP.NET Core Security Feature Bypass Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Record
CVE-2026-114157
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Weakness
CWE-362
Updated
2026-11-10
EUVDEUVD-2026-1219807.5

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Record
EUVD-2026-121980
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Updated
2026-11-11
GitHub AdvisoriesGHSA-7phj-vgxq-r67h6.5

Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core's Kestrel Named Pipes transport. This advisory provides guidance on updating affected applications and components.

A Kestrel named-pipe listener configured with CurrentUserOnly can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/507

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 7.5 (base score)
  • Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
  • Weakness: CWE-362
  • MSRC severity: Important
  • Impact: Security Feature Bypass

Affected Platforms

  • Platforms: Windows
  • Architectures: Arm64, x64, x86

<a name="affected-packages"></a>Affected Packages

Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes ships in the ASP.NET Core shared framework and runtime packs; it is not a separately packable NuGet package.

Affected intervals and patched release versions are listed below.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

The .NET 11.0.0 release is fixed; affected prereleases are listed above.

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Review Windows applications that use Kestrel's Named Pipes transport and identify their deployed ASP.NET Core versions. Compare deployed versions with the affected intervals above. Self-contained…

Record
GHSA-7phj-vgxq-r67h
CVSS 3.1
6.5 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Weakness
CWE-362
Updated
2026-11-11
GitHub AdvisoriesGHSA-95x6-7hq8-2c377.5

Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.

Original Description

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Record
GHSA-95x6-7hq8-2c37
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-362
Updated
2026-11-10
NVD7.5

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Record
CVE-2026-114157
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-362
Updated
2026-11-10
OSVALPINE-CVE-2026-1141577.5

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Record
ALPINE-CVE-2026-114157
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-13
OSVGHSA-7phj-vgxq-r67h7.5

Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability

Executive summary

Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core's Kestrel Named Pipes transport. This advisory provides guidance on updating affected applications and components.

A Kestrel named-pipe listener configured with CurrentUserOnly can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path.

Announcement

Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/507

CVSS Details

  • Version: 3.1
  • Severity: High
  • Score: 7.5 (base score)
  • Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
  • Weakness: CWE-362
  • MSRC severity: Important
  • Impact: Security Feature Bypass

Affected Platforms

  • Platforms: Windows
  • Architectures: Arm64, x64, x86

<a name="affected-packages"></a>Affected Packages

Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes ships in the ASP.NET Core shared framework and runtime packs; it is not a separately packable NuGet package.

Affected intervals and patched release versions are listed below.

.NET 8.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 8.0.0-preview.1.23112.2, <= 8.0.33 | 8.0.34

.NET 9.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 9.0.0-preview.1.24081.5, <= 9.0.22 | 9.0.23

.NET 10.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 10.0.0-preview.1.25120.3, <= 10.0.14 | 10.0.15

.NET 11.0 - affected runtime packages

Package | Affected version | Patched version --- | --- | --- Microsoft.AspNetCore.App.Runtime.win-arm64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x64 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0 Microsoft.AspNetCore.App.Runtime.win-x86 | >= 11.0.0-preview.1.26104.118, <= 11.0.0-rc.3.26522.148 | 11.0.0

The .NET 11.0.0 release is fixed; affected prereleases are listed above.

Advisory FAQ

<a name="how-affected"></a>How do I know if I am affected?

Review Windows applications that use Kestrel's Named Pipes transport and identify their deployed ASP.NET Core versions. Compare deployed versions with the affected intervals above. Self-contained…

Record
GHSA-7phj-vgxq-r67h
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
Weakness
CWE-362
Updated
2026-11-11
OSVGHSA-95x6-7hq8-2c377.5

Duplicate Advisory: Microsoft Security Advisory CVE-2026-114157 - ASP.NET Core Security Feature Bypass Vulnerability

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7phj-vgxq-r67h. This link is maintained to preserve external references.

Original Description

Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Record
GHSA-95x6-7hq8-2c37
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weakness
CWE-362
Updated
2026-11-10
OSVUBUNTU-CVE-2026-1141577.5

A Kestrel named-pipe listener configured with CurrentUserOnly can lose protected namespace ownership during recovery, allowing another local user to claim the pipe path.

Record
UBUNTU-CVE-2026-114157
CVSS 3.1
7.5 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Updated
2026-11-12

History

History
RecordedChangedSources
affectedOSV
affected, aliases, referencesOSV
affected, aliases, published, referencesOSV
publishedEUVD
publishedEUVD
affected, referencesOSV
affected, aliases, facts, referencesGitHub Advisories
publishedEUVD
referencesGitHub Advisories, OSV
publishedEUVD, NVD
aliases, referencesGitHub Advisories
cwes, references, severity, titleCVE List
first indexedEUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 16 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open