CVE-2026-114146: ASP.NET Core Elevation of Privilege Vulnerability

While Microsoft rates the overall severity as Important, the underlying metrics tell a story that enterprise developers and systems administrators should not ignore: it carries a CVSS base score of 9.0 and a CVSS temporal score of 7.8. If your infrastructure runs cross-platform .NET workloads on Windows, Linux, or Mac OS—or if your development teams are building with Visual Studio 2022 or Visual Studio 2026—this Microsoft security patch belongs at the top of your maintenance queue.

Technical Overview: CWE-863 and the Mechanics of CVE-2026-114146​

At the heart of CVE-2026-114146 is an authorization flaw categorized under CWE-863 (Incorrect Authorization). According to Microsoft's official advisory description, Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.

To understand how the flaw operates in practice, we only need to look at the official advisory facts provided by the Microsoft Security Response Center (MSRC):

• ASP.NET Core Elevation of Privilege Vulnerability: Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
• How could an attacker exploit this vulnerability? An authenticated attacker could convince a privileged user to follow a specially crafted link to an affected application. Successful exploitation could allow the attacker to perform actions with that user's application privileges.

Why does a vulnerability rated Important carry a 9.0 base score? Based on general industry knowledge of the Common Vulnerability Scoring System (CVSS v3.1), the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C explains the math clearly:

• Attack Vector (AV:N) & Attack Complexity (AC:L): The attack is bound to the network stack and requires low complexity to pull off once the conditions are met.
• Privileges Required (PR:L) & User Interaction (UI:R): The attacker cannot be an anonymous passerby; they must already be authenticated with low privileges (PR:L). Furthermore, they need a privileged user to take the bait and click a specially crafted link (UI:R).
• Scope Changed (S:C) & High Impact (C:H/I:H/A:H): Because the vulnerability allows an authenticated low-privilege user to hijack the application privileges of a higher-privileged user across the security boundary of the application's authorization context, the scope changes (S:C), resulting in high impact to confidentiality, integrity, and availability within that context.

Official Threat and Status Indicators​

For security operations teams triaging this advisory, the official status profile for CVE-2026-114146 is as follows:

• Vulnerability Title: ASP.NET Core Elevation of Privilege Vulnerability
• CVE ID: CVE-2026-114146
• Severity: Important
• CVSS Base Score: 9.0
• CVSS Temporal Score: 7.8
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-863
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Section Summary: CVE-2026-114146 is an Important-severity elevation of privilege flaw rooted in CWE-863. Although it is not currently exploited in the wild and has an assessment of Exploitation Less Likely, successful exploitation via a crafted link lets an authenticated attacker assume a privileged user's application permissions.

Affected Products, KB Articles, and Fixed Builds​

Because .NET is a modular, cross-platform ecosystem, a flaw in ASP.NET Core ripples outward across operating systems, integrated development environments (IDEs), and NuGet packages. Whether you are running production Linux containers, developing on Mac OS, or managing Windows Server estates and developer workstations, every affected runtime and toolset requires attention.

Below is the complete, authoritative table of affected products, knowledge base (KB) identifiers, and vendor fixed versions for CVE-2026-114146:

Section Summary: The vulnerability spans four major .NET generations (.NET 8.0, 9.0, 10.0, and 11.0) across Windows, Linux, and Mac OS, alongside Visual Studio 2022 (17.14), Visual Studio 2026 (18.11 and 18.12), and the Microsoft.AspNetCore.Http.Connections package.

Official Remediation Guidance​

Because Customer action required: Yes applies to this advisory, administrators and developers must apply the corresponding updates across their environments. Below are the exact remediation instructions for every affected product:

• For .NET 10.0 installed on Linux, install KB5135241 to reach fixed build 10.0.15.
• For .NET 10.0 installed on Mac OS, install KB5135241 to reach fixed build 10.0.15.
• For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.15.
• For .NET 11.0 installed on Linux, update to fixed build 11.0.0 or later.
• For .NET 11.0 installed on Mac OS, update to fixed build 11.0.0 or later.
• For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later.
• For .NET 8.0 installed on Linux, install KB5135243 to reach fixed build 8.0.34.
• For .NET 8.0 installed on Mac OS, install KB5135243 to reach fixed build 8.0.34.
• For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.34.
• For .NET 9.0 installed on Linux, install KB5135242 to reach fixed build 9.0.23.
• For .NET 9.0 installed on Mac OS, install KB5135242 to reach fixed build 9.0.23.
• For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.23.
• For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.45 or later.
• For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
• For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
• For Microsoft.AspNetCore.Http.Connections, update to fixed build 1.2.14 or later.

Practical Impact for IT Admins and .NET Developers​

Why do we see Microsoft.AspNetCore.Http.Connections called out right alongside the full .NET runtimes and Visual Studio IDEs? Synthesizing from general industry knowledge of the .NET architecture, patching a modern web application stack is rarely a one-click affair.

1. Framework-Dependent vs. Self-Contained Deployments: If your ASP.NET Core applications are deployed as framework-dependent apps on Windows or Linux servers, installing KB5135243 (for .NET 8.0 to reach 8.0.34), KB5135242 (for .NET 9.0 to reach 9.0.23), KB5135241 (for .NET 10.0 to reach 10.0.15), or updating to .NET 11.0 build 11.0.0 at the host level secures the shared runtime. However, if your CI/CD pipelines compile self-contained executables or build container images with pinned runtime layers, you must rebuild and redeploy those artifacts using the updated SDKs and base images.
2. Direct Package References: Applications that explicitly reference Microsoft.AspNetCore.Http.Connections must have their dependency trees audited and updated to fixed build 1.2.14 or later, followed by a clean recompile and deployment.
3. Securing Developer Workstations: Developer machines running Microsoft Visual Studio 2022 version 17.14 or Microsoft Visual Studio 2026 version 18.11 / 18.12 bundle SDKs and local web development runtimes. Updating Visual Studio to 17.14.45, 18.11.4, or 18.12.0 ensures that local environments and build agents do not reintroduce vulnerable runtime components during packaging.

Verification Checklist for Administrators​

To make sure your patching cycle actually sticks, run through these quick verification steps across your fleet:

• Check Installed Runtimes: On Windows, Linux, or Mac OS hosts, verify the active runtime builds to confirm your machines have reached 8.0.34, 9.0.23, 10.0.15, or 11.0.0.
• Audit NuGet Dependencies: Check project lock files and dependency manifests for Microsoft.AspNetCore.Http.Connections and verify that any references resolve to 1.2.14 or later.
• Verify Visual Studio Builds: Have development teams check their Visual Studio installer versions to confirm they are running 17.14.45 (for 2022 v17.14), 18.11.4 (for 2026 v18.11), or 18.12.0 (for 2026 v18.12) or later.

Section Summary: Patching CVE-2026-114146 requires coordinating server runtime updates with developer IDE updates and NuGet dependency audits so that neither host machines nor recompiled deployment packages remain exposed.