The practical takeaway: match each installed product and release branch to its own fixed build. Microsoft’s remediation list is broader than a single Windows update, and completing one entry should not be treated as completing them all.
What the vulnerability does
Microsoft’s advisory names the issue “ASP.NET Core Denial of Service Vulnerability” and describes it as follows:
The weakness is classified as CWE-770. The stated impact is service availability: an attacker can cause denial of service through uncontrolled resource consumption.
Microsoft provides these severity and assessment details:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-114149 |
| Severity | Important |
| CVSS base score | 7.5 |
| CVSS temporal score | 6.5 |
| Weakness | CWE-770 |
| Exploitation assessment | Exploitation Less Likely |
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
What the score means for patch prioritization
The vector describes a network-accessible attack with low attack complexity, no required privileges and no user interaction. It assigns high availability impact, with no confidentiality or integrity impact scored and unchanged scope.
That distinction matters. This advisory concerns disruption of service, rather than a scored ability to read or alter data. An application does not have to leak information to cause operational trouble: being unavailable can be enough.
Microsoft’s Exploitation Less Likely assessment and the vector’s low attack complexity describe different things. The former is an exploitation assessment; the latter describes attack conditions within the scoring model. Administrators should not interpret “less likely” as a reason to disregard the explicit customer-action requirement.
Affected .NET products and exact remediation
Microsoft’s affected-product records map the .NET branches to distinct fixes. The following instructions preserve those product names and remediation targets exactly.
.NET 10.0 — KB5135241, fixed build 10.0.15
- For .NET 10.0 installed on Linux, install KB5135241 to reach fixed build 10.0.15.
- For .NET 10.0 installed on Mac OS, install KB5135241 to reach fixed build 10.0.15.
- For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.15.
.NET 11.0 — fixed build 11.0.0
- For .NET 11.0 installed on Linux, update to fixed build 11.0.0 or later.
- For .NET 11.0 installed on Mac OS, update to fixed build 11.0.0 or later.
- For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later.
.NET 8.0 — KB5135243, fixed build 8.0.34
- For .NET 8.0 installed on Linux, install KB5135243 to reach fixed build 8.0.34.
- For .NET 8.0 installed on Mac OS, install KB5135243 to reach fixed build 8.0.34.
- For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.34.
.NET 9.0 — KB5135242, fixed build 9.0.23
- For .NET 9.0 installed on Linux, install KB5135242 to reach fixed build 9.0.23.
- For .NET 9.0 installed on Mac OS, install KB5135242 to reach fixed build 9.0.23.
- For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.23.
The useful comparison here is that the fixed build is consistent across the three listed operating systems within each .NET branch, but differs between branches. Patch tracking therefore needs both the operating system and the installed .NET branch—not merely a machine-level “updated” checkbox.
Visual Studio and package fixes
Microsoft also identifies separate remediation targets for development tools and Microsoft.AspNetCore.WebUtilities. The Visual Studio targets are associated with Microsoft’s release notes; the package target appears in the affected-product records.
- For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.45 or later.
- For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
- For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
- For Microsoft.AspNetCore.WebUtilities, update to fixed build 11.0.0 or later.
These are separate entries in Microsoft’s remediation guidance. For a Windows development PC, the practical finding is that checking Visual Studio alone is not a complete review of the advisory: the affected .NET installations and Microsoft.AspNetCore.WebUtilities also need to be assessed against their own targets.
Likewise, the distinct Visual Studio branch targets should remain distinct in deployment records. A generic instruction to “update Visual Studio” loses the version information needed to verify completion.
A focused patching plan
The following operational recommendations are derived from the advisory’s network attack conditions and product-specific fix mappings, rather than additional Microsoft installation instructions:
- Inventory against the complete list. Identify the listed .NET installations, Visual Studio branches and Microsoft.AspNetCore.WebUtilities usage within your managed environment.
- Prioritize exposed services. Because the advisory describes an unauthorized network attack against availability, give early attention to affected application deployments reachable by untrusted clients.
- Assign each finding its exact target. Record the applicable KB and fixed build, or the specified fixed-version target, before deployment.
- Validate each product separately. After updating, compare the installed version with the corresponding remediation entry. Do not use a successful update to one product as evidence that another entry is resolved.
- Confirm application health. Check that affected services remain available and that normal application workflows function after remediation.
Bottom line: CVE-2026-114149 requires action across a cross-platform application stack, not just the Windows machines that may host or develop it. Microsoft supplies concrete fixed builds for every listed product. The most reliable response is to turn those mappings into a product-by-product checklist, apply the relevant fixes and verify both version compliance and service health.