Microsoft’s remediation guidance covers three .NET branches installed on Windows, three Visual Studio branches, and Microsoft.AspNetCore.Server.HttpSys. The practical priority is to match each affected component to its own fixed build rather than treating one update as a blanket fix.
What the vulnerability does
Microsoft’s official advisory states:
The advisory identifies CWE-401 as the weakness classification. Its scoring details are:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-114154 |
| Severity | Important |
| CVSS base score | 7.5 |
| CVSS temporal score | 6.5 |
| CWE | CWE-401 |
| Exploitation assessment | Exploitation Less Likely |
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
The advisory also records:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
These statuses describe Microsoft’s advisory assessment. “Exploitation Less Likely” is not a reason to disregard the required updates.
Why availability is the central concern
The CVSS vector helps distinguish this vulnerability from a data-theft or code-execution issue. It describes a network attack path, low attack complexity, no required privileges, and no required user interaction. The scored impact is high for availability, with no confidentiality or integrity impact scored and an unchanged scope.
For administrators, that combination matters: an attacker does not need an account or a user clicking something to satisfy the scored attack conditions. The security concern is disruption of the affected service.
That is an interpretation of the supplied vector, not a claim about a particular attack payload or observed incident. It also explains why the Important label and the 7.5 base score deserve attention even alongside Microsoft’s lower exploitation-likelihood assessment. Service availability is a security property, too.
Affected products and exact fixes
Microsoft’s affected-product guidance provides the following remediation instructions. Each line preserves the applicable product, update identifier where supplied, and fixed build:
- For .NET 10.0 installed on Windows, install KB5135241 to reach fixed build 10.0.15.
- For .NET 8.0 installed on Windows, install KB5135243 to reach fixed build 8.0.34.
- For .NET 9.0 installed on Windows, install KB5135242 to reach fixed build 9.0.23.
- For Microsoft Visual Studio 2022 version 17.14, update to fixed build 17.14.45 or later.
- For Microsoft Visual Studio 2026 version 18.11, update to fixed build 18.11.4 or later.
- For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
- For Microsoft.AspNetCore.Server.HttpSys, update to fixed build 2.3.14 or later.
The branch-specific mappings are important. KB5135241, KB5135243, and KB5135242 correspond to different .NET branches; they are not interchangeable entries on a generic patch checklist. Likewise, each listed Visual Studio branch has its own fixed-build target.
Turn the advisory into a verification checklist
The useful operational takeaway is to track remediation by component and branch, not merely by machine. The supplied mappings identify separate update targets, so evidence that one target is fixed does not establish that the others have been addressed.
A practical rollout checklist is:
- Inventory the listed components. Establish which affected .NET branches, Visual Studio branches, and Microsoft.AspNetCore.Server.HttpSys dependencies are present in the environment.
- Assign the matching remediation. Use the exact product-to-build mappings above when preparing deployment work.
- Prioritize service exposure. As an operational judgment based on the network attack vector and availability impact, give particular attention to affected components supporting network-reachable applications.
- Verify the resulting versions. Record the installed or deployed build against the relevant fixed-build target rather than relying solely on an update job’s completion status.
- Validate application health. Confirm that affected applications remain available and behave as expected after remediation.
These are deployment recommendations derived from the advisory’s scope, not additional vendor-prescribed installation steps.
Bottom line: CVE-2026-114154 is an unauthenticated, network-reachable denial-of-service vulnerability with explicit customer action required. Microsoft’s exploitation assessment provides context, but the actionable result is straightforward: apply the appropriate fixes and verify every affected component against its own target build.