For administrators and development teams, the practical distinction is that this advisory reaches both application-runtime installations and development tooling. Checking only Windows systems—or only Visual Studio workstations—would leave part of the affected-product list outside the review.
What the vulnerability allows
Microsoft’s official advisory describes the issue as follows:
The advisory assigns the weakness identifier CWE-41. Its stated impact is a security-feature bypass; teams should assess that impact rather than treating the issue as a different vulnerability category.
Microsoft provides these severity and scoring details:
| Field | Advisory value |
|---|---|
| CVE | CVE-2026-114156 |
| Exact title | ASP.NET Core Security Feature Bypass Vulnerability |
| Severity | Important |
| CVSS base score | 6.5 |
| CVSS temporal score | 5.7 |
| Weakness | CWE-41 |
| Exploitation assessment | Exploitation Less Likely |
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C
Microsoft’s advisory status fields state:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Those status fields describe the advisory’s assessment, not a reason to skip remediation.
How to interpret the risk
The vector provides useful context beyond the headline score. It describes a network attack path with high attack complexity, no privileges required and no user interaction required. Its impact components indicate low confidentiality impact, high integrity impact and no availability impact, with scope unchanged.
For patch planning, that combination deserves a careful reading: high attack complexity does not mean authentication is required. The vector explicitly separates those conditions. An attacker faces the stated complexity requirement, but the assessment does not depend on an existing privileged account or a user taking an action.
Likewise, Microsoft’s Exploitation Less Likely assessment should inform prioritization without overriding the explicit requirement for customer action. The supported response is to identify the listed installations and move them to the corresponding fixed builds.
Affected products and fixed versions
Microsoft’s affected-product information and Visual Studio release information identify the following vendor fixed versions:
| Affected product | Vendor fixed version |
|---|---|
| .NET 11.0 installed on Linux | 11.0.0 |
| .NET 11.0 installed on Mac OS | 11.0.0 |
| .NET 11.0 installed on Windows | 11.0.0 |
| Microsoft Visual Studio 2026 version 18.12 | 18.12.0 |
The prescribed remediation is:
- For .NET 11.0 installed on Linux, update to fixed build 11.0.0 or later.
- For .NET 11.0 installed on Mac OS, update to fixed build 11.0.0 or later.
- For .NET 11.0 installed on Windows, update to fixed build 11.0.0 or later.
- For Microsoft Visual Studio 2026 version 18.12, update to fixed build 18.12.0 or later.
A practical way to close the loop
The product mapping supports a straightforward administrative checklist:
- Inventory all four listed product entries. Keep the operating-system-specific .NET installations and the Visual Studio entry distinct.
- Apply the matching remediation. The .NET entries share fixed build 11.0.0, while the listed Visual Studio entry maps to 18.12.0.
- Verify the resulting installed build. Record the product, platform and installed build against the applicable remediation before marking the item complete.
This checklist is an operational interpretation of Microsoft’s supplied fix mapping, not an additional vendor procedure. Its value is avoiding a common tracking mistake: treating one updated product as evidence that every affected installation has been addressed.
The bottom line is clear: CVE-2026-114156 requires an update across the applicable listed products, with separate verification for .NET installations and Visual Studio.